Adobe Photoshop: NULL pointer dereference allows denial of service
Summary
Adobe Photoshop Desktop 27.11 and earlier (2026 line) and 26.11.8 and earlier (2025 line) on Windows and macOS contain a NULL pointer dereference (CWE-476). A local attacker can crash the application by getting a victim to open a crafted file, which causes a denial of service. The CVE record describes only availability impact, and no unauthenticated remote attack path is documented. Adobe fixed the issue in security bulletin APSB26-181; the CVSS 3.1 score is 5.5 (Medium).
Affected
- Adobe Photoshop 2026: 27.11 and earlier (Windows and macOS)
- Adobe Photoshop 2025: 26.11.8 and earlier (Windows and macOS)
Fixed in
- Adobe Photoshop 2026: 27.11.1 or later
- Adobe Photoshop 2027: 28.0 (named in the Adobe bulletin; the CVE record lists 28.0 as unaffected)
- Adobe Photoshop 2025: no further update is planned; move to Photoshop 2026 27.11.1 or Photoshop 2027 28.0
Workaround
Unknown. No vendor workaround is documented; patching is the only documented fix.
- Interim, pending the update: do not open image or document files from untrusted sources (general guidance, not a vendor recommendation).
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- OffSeq lists the CVE as not known to be exploited.
- No public proof of concept was found in the sources checked. No CISA KEV listing was found.
- CISA SSVC assessment: exploitation none, not automatable.
Our recommendation
- Update Photoshop 2026 to version 27.11.1 or later via the Creative Cloud desktop app or the Admin Console.
- Replace Photoshop 2025 installations with Photoshop 2026 27.11.1 or Photoshop 2027 28.0, because 2025 receives no further updates.
- Prioritise workstations that open files from external customers or suppliers, and shared or file-exchange workstations.
- Remind users not to open files from untrusted sources until the update is installed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-181 www.adobe.com
- CVE Record CVE-2026-118198 www.cve.org
- OffSeq Radar: CVE-2026-118198 radar.offseq.com
- Strix: CVE-2026-118198 www.strix.ai
- Zero Day Initiative: November 2026 security update review www.zerodayinitiative.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:11.
Original description (NVD)
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.