CVE-2026-95637

HighCVSS 7.8/10Last modified Oct 22, 2026

Description

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Oct 13, 2026
Last modified: Oct 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-956387.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-956398.6Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of th CVE-2026-95642.4A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown fu CVE-2026-956405.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-956417.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-95656.3A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-taur CVE-2026-956537.5Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, m CVE-2026-956547.4Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-ch CVE-2026-956558.1Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitra CVE-2026-956567.3A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function add_watch_ui_snapshot of th CVE-2026-956573.5A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the fi CVE-2026-956586.9MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing