Adobe Photoshop: Divide by zero causes application denial-of-service
Summary
A divide-by-zero flaw (CWE-369) in Adobe Photoshop Desktop allows an attacker to crash the application, causing a denial-of-service condition. The attack requires a local user to open a malicious file, so it cannot be triggered remotely over the network. Adobe rates the issue as medium (CVSS 3.1 5.5) with an impact on availability only.
Affected
- Adobe Photoshop 2026: version 27.11 and earlier (Windows and macOS)
- Adobe Photoshop 2025: version 26.11.8 and earlier (Windows and macOS)
Fixed in
- Adobe Photoshop 2026: version 27.11.1 or later
- Adobe Photoshop 2027: version 28.0 or later
- Adobe Photoshop 2025: no fix, the product receives no further updates
Workaround
Unknown. Adobe documents no workaround. Until the update is installed, do not open files from untrusted sources.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- CISA SSVC assessment: exploitation none, automatable no.
- No public proof of concept found.
Our recommendation
- Identify all Photoshop 2025 installations and plan an upgrade to Photoshop 2026 version 27.11.1 or Photoshop 2027 version 28.0.
- Update Photoshop 2026 to version 27.11.1 or later via the Creative Cloud desktop app or the Admin Console.
- Until updated, avoid opening image files from unknown or untrusted sources, especially in design and print teams.
- Apply the full update, because the same bulletin fixes several higher-rated Photoshop vulnerabilities, including code execution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-181 www.adobe.com
- CVE Record CVE-2026-114373 www.cve.org
- HKCERT Adobe monthly security update November 2026 www.hkcert.org
- Zero Day Initiative November 2026 security update review www.zerodayinitiative.com
- OffSeq threat entry CVE-2026-114373 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:12.
Original description (NVD)
Photoshop Desktop is affected by a Divide By Zero vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.