Adobe Photoshop: NULL pointer dereference allows application denial-of-service
Summary
Adobe Photoshop 2025 and 2026 contain a NULL pointer dereference (CWE-476) that can crash the application. An attacker needs local access and must get a user to open a malicious file, for example one received by email or downloaded. The CVE is rated for application denial-of-service only. The fix is included in Adobe security bulletin APSB26-181 from November 10, 2026.
Affected
- Adobe Photoshop 2026: 27.11 and earlier (Windows and macOS)
- Adobe Photoshop 2025: 26.11.8 and earlier (Windows and macOS)
- Linux is not listed.
Fixed in
- Adobe Photoshop 2026: update to 27.11.1
- Adobe Photoshop 2027: update to 28.0
- Photoshop 2025 will not receive a further update. Adobe advises 2025 users to move to Photoshop 2026 27.11.1 or Photoshop 2027 28.0.
- The CVE record lists 28.0 for the 2025 range, which differs from the advisory wording. Unknown whether this is intended.
Workaround
Unknown. No vendor-documented workaround was found.
- Interim measure: open Photoshop files only from trusted senders until the update is installed.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in APSB26-181.
- OffSeq lists this CVE as not known to be exploited (evidence rating: thin).
- No public proof of concept was found. This is not confirmed absence.
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
Our recommendation
- Deploy the Photoshop update through the Creative Cloud desktop app, or through the Admin Console in managed environments. Deploy the whole APSB26-181 bulletin.
- Prioritise Photoshop 2025 installations and move them to a supported version.
- Remind users not to open untrusted files in design tools.
- The bulletin's highest rating is High (7.8). This CVE alone is Medium (5.5).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-181 www.adobe.com
- CVE Record CVE-2026-113571 www.cve.org
- OffSeq Radar: CVE-2026-113571 radar.offseq.com
- ZDI: November 2026 Security Update Review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:15.
Original description (NVD)
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.