CVE-2026-96521: Out-of-bounds Write (CWE-787) in Adobe Photoshop

CVE-2026-96521 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that may lead to arbitrary code execution in the context of the current user. Successful exploitation depends on user interaction, requiring the victim to open a specially crafted malicious file. The vulnerability affects Photoshop versions up to 27.10 and 26.11.7 inclusive. The CVSS 3.1 vector indicates the attack vector is local (AV:L), with low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). There are no known exploits in the wild and no vendor patch links provided in the input data.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment within the context of Photoshop. The attack requires the user to open a malicious file, which means social engineering or tricking the user is necessary. The high CVSS score reflects the significant confidentiality, integrity, and availability impacts possible.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening files from untrusted sources to mitigate risk. No official fix or temporary workaround is provided in the available data.