CVE-2026-97312 Adobe CVE debrief

Who should care

Users of Adobe Photoshop Desktop, particularly those who open files from untrusted sources, should assess their exposure and update to a fixed version.

Why it matters

CVE-2026-97312 is a high-severity vulnerability in Adobe Photoshop Desktop that could lead to arbitrary code execution. Users who open files from untrusted sources should update Photoshop immediately to prevent potential exploitation.

• Potential arbitrary code execution upon opening malicious files.
• Requires immediate attention for users handling untrusted files.
• Necessitates updates to Adobe Photoshop to prevent exploitation.

Technical summary

Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. The vulnerability has a CVSS score of 7.8 and is classified as CWE-787. Users should update Adobe Photoshop to the latest version to prevent potential exploitation.

Defensive priority

High priority for updating Adobe Photoshop to a version that addresses this vulnerability.

Recommended defensive actions

• Update Adobe Photoshop to the latest version.
• Restrict user access to untrusted files.
• Implement monitoring for suspicious file openings.

Evidence notes

The CVE record and source item provide details on the vulnerability. Adobe has released an advisory addressing this issue. The vulnerability is a high-severity issue that requires immediate attention for users handling untrusted files. The CVE Program and NIST NVD have documented this vulnerability, and users should review these sources for further information. Evidence is limited to publicly available data and may not reflect the full scope of affected systems or potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.