CVE-2026-82005

HighCVSS 7.8/10Last modified Sep 11, 2026

Description

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Adobe	Photoshop 2026	<= 27.6
Adobe	Photoshop 2025	<= 26.11.6

References

https://helpx.adobe.com/security/products/photoshop/apsb26-130.htmlVendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-820067.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-820077.8Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the contex CVE-2026-820089.9Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the CVE-2026-820099.1Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab CVE-2026-82018.8A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mong CVE-2026-820109.9Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab CVE-2026-820119.1Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerab CVE-2026-820127.8Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current CVE-2026-820139.9Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A CVE-2026-820144.3Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, throug CVE-2026-820177.6IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers wit CVE-2026-820186.1IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that