CVE-2026-96522 Adobe CVE debrief

Who should care

Defenders responsible for managing Adobe Photoshop installations, particularly in environments where users frequently open files from untrusted sources, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about CVE-2026-96522 because it affects Adobe Photoshop Desktop and could lead to arbitrary code execution if exploited. The vulnerability requires user interaction and has a HIGH severity score. Affected versions include Photoshop 27.10 and earlier, as well as 26.11.7 and earlier. Remediation involves upgrading to unaffected versions, specifically 27.11 or 26.11.8 and later.

• Potential arbitrary code execution if a user opens a malicious file
• Requires user interaction to exploit
• HIGH severity with a CVSS score of 7.8

Technical summary

Photoshop Desktop versions 27.10 and earlier, as well as 26.11.7 and earlier, are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Adobe has released an advisory APSB26-158 with more information on the affected products and recommended actions.

Defensive priority

Defenders should prioritize verifying and upgrading to unaffected Photoshop versions, specifically 27.11 or 26.11.8 and later, and ensure users do not open malicious files.

Recommended defensive actions

• Verify and upgrade to unaffected Photoshop versions
• Ensure users do not open malicious files
• Monitor for and respond to potential exploitation attempts

Evidence notes

The CVE Program and NVD provide official records of this vulnerability. Adobe has released a vendor advisory APSB26-158 with details on the affected products and recommended actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.