Photoshop Out-of-Bounds Read: RCE Risk for Desktop Users

The National Vulnerability Database has flagged a critical out-of-bounds read vulnerability, identified as CVE-2026-27289, affecting Adobe Photoshop Desktop versions 27.4 and earlier. This flaw arises when the software attempts to parse a specially crafted file, leading to a read operation beyond the allocated memory structure. The implications are significant: a successful exploit could enable an attacker to execute arbitrary code within the context of the current user.

While the CVSS score of 7.8 (HIGH) paints a grim picture, it’s worth noting that exploitation isn’t entirely silent. According to the National Vulnerability Database, user interaction is a prerequisite; a victim must actively open a malicious file for the attack to succeed. This means social engineering or phishing tactics would likely be involved to trick users into opening the booby-trapped file. The underlying weakness is categorized as CWE-125, a common vulnerability class related to out-of-bounds reads.