- The Mess: Adobe patched multiple critical Photoshop flaws that can turn a malicious file into arbitrary code execution. Three of the bugs come from integer-overflow conditions in image parsing.
- The Damage: A user opening a specially crafted Photoshop file can give attacker-controlled code a path into the desktop environment.
- The Fix: Update Photoshop to 27.7 or 26.11.7 immediately.
Photoshop just received another security cleanup, and this one is not about cosmetic bugs.
Adobe’s September security bulletin fixes eight critical vulnerabilities in Photoshop. All can lead to arbitrary code execution, although the exact attack paths differ.
The affected versions are:
- Photoshop 2026 — 27.6 and earlier
- Photoshop 2025 — 26.11.6 and earlier
The patched versions are 27.7 and 26.11.7. Adobe released the update on September 8, 2026.
Three Integer Overflows Stand Out
Three vulnerabilities are particularly interesting because they sit in Photoshop’s image-processing code:
- CVE-2026-75862
- CVE-2026-75863
- CVE-2026-75771
Adobe classifies all three as integer overflow or wraparound vulnerabilities with a CVSS score of 7.8.
Their impact is the same: arbitrary code execution.
All three were credited to Brandon Evans of TrendAI Zero Day Initiative.
Integer overflow bugs are dangerous in parsers because malformed dimensions, offsets or size calculations can make the application allocate or write memory using values that no longer represent what the programmer expected.
Photoshop processes an enormous number of complex file formats.
That makes parsing code an attractive attack surface.
It Doesn’t Stop There
Adobe’s bulletin lists five additional critical Photoshop vulnerabilities:
- CVE-2026-76199 — uncontrolled search path element
- CVE-2026-82007 — integer overflow
- CVE-2026-82006 — heap-based buffer overflow
- CVE-2026-75631 — out-of-bounds write
- CVE-2026-82005 — out-of-bounds write
Each is classified as capable of producing arbitrary code execution. CVE-2026-76199 carries the highest CVSS score in the group at 8.6.
The remaining memory-corruption vulnerabilities score 7.8.
The Attack Still Needs User Interaction
These are not Internet-facing server bugs.
The standard attack model requires a victim to interact with malicious content.
That could mean opening a crafted Photoshop document received through email, downloaded from the web, obtained from a collaboration platform or delivered through another social-engineering route.
The CVSS vectors for the image-parsing issues explicitly include UI:R — user interaction required.
That lowers the score compared with a remote, unauthenticated server exploit.
It does not make the vulnerability harmless.
Photoshop documents are routinely exchanged between users, agencies, designers, contractors and customers. A malicious file can therefore arrive disguised as normal creative work.
Adobe Says There Is No Known Exploitation
Adobe states that it is not aware of exploits in the wild for the vulnerabilities addressed by this update.
That’s good news.
It also means this is exactly the moment when patching is cheap.
Once technical details, proof-of-concept code or weaponized samples appear, the economics change quickly.
What To Check
Administrators managing Creative Cloud environments should verify the actual installed Photoshop version rather than assuming users received the update.
For Photoshop 2026, the target is:
27.7
For Photoshop 2025:
26.11.7
Adobe recommends updating through the Creative Cloud desktop application. Managed environments can deploy the update through Adobe Admin Console.
Also check whether Photoshop is allowed to open files directly from untrusted locations.
Restricting risky document handling can reduce exposure, but it is not a substitute for the patch.
Bugstoday Opinion
Photoshop is not a network daemon.
That doesn’t make a parser RCE academic.
A designer opening one malicious file is enough to turn an otherwise normal workstation into an execution target.
The September patch also shows why image-processing code remains such a productive hunting ground: integer overflow, heap corruption and out-of-bounds writes keep appearing in software that processes attacker-controlled files.
Adobe says there is no known exploitation right now.
Good.
Patch before that sentence becomes outdated.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Adobe — APSB26-130 Security Update for Photoshop
CVE.org / MITRE — CVE-2026-75862
CVE.org / MITRE — CVE-2026-75863
CVE.org / MITRE — CVE-2026-75771
TrendAI Zero Day Initiative — Adobe Photoshop vulnerability research
