CVE-2026-96522: Out-of-bounds Write (CWE-787) in Adobe Photoshop

CVE-2026-96522 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that can lead to arbitrary code execution in the context of the current user. The flaw requires the victim to open a specially crafted malicious file to trigger the vulnerability. This vulnerability affects Adobe Photoshop versions up to and including 27.10 and 26.11.7. The CVSS 3.1 vector indicates local attack vector with low attack complexity, no privileges required, but user interaction is necessary. The impact includes high confidentiality, integrity, and availability impact.

Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment within the context of Photoshop. The attack requires user interaction (opening a malicious file). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening files from untrusted or unknown sources to mitigate the risk of exploitation.