CVE-2026-75863

HIGH 7.8 ALL-YEARS

Published 2026-09-08 · Last modified 2026-09-09 · adobe · NVD: Analyzed

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

ELEVATED IMPACT

Severe if exploited (CVSS 7.8), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 24th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

7.8CVSS 3.1 · HIGH · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Adobe Apple Microsoft

Products Photoshop 2026 Photoshop 2025 Photoshop Macos Windows

Weakness (CWE)

CWE-190: Integer Overflow or Wraparound (CWE-190)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References and research data (JSON)

Known Affected Software Configurations

Vendor	Product	Version range
Adobe	Photoshop	≥ 26.0 and < 26.11.7
Adobe	Photoshop	≥ 27.0 and < 27.7

All CVSS metrics

HIGH 7.8 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
HIGH 7.8 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Advisories

https://helpx.adobe.com/security/products/photoshop/apsb26-130.html vendor-advisoryVendor AdvisoryCVE record · adobe · Updated 2026-09-08T19:32:51.016Z
NVD · CVE-2026-75863 · Updated 2026-09-11T18:32:31.353
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-74058 ADVISORYEUVD · EUVD-2026-74058

Sources: NVD · CVE.org · All sources and attribution · EPSS