Adobe Photoshop: Double free vulnerability allows code execution
Summary
A double free vulnerability (CWE-415) in Adobe Photoshop Desktop can allow an attacker to execute arbitrary code with the rights of the current user. Exploitation requires that a victim opens a malicious file, so the risk comes from crafted images or documents received by email, shared folders or downloads. The CVSS base score is 7.8 (High), and the vulnerability is fixed in the October 2026 update APSB26-158.
Affected
- Photoshop 2026: version 27.10 and earlier (Windows and macOS)
- Photoshop 2025: version 26.11.7 and earlier (Windows and macOS)
Fixed in
- Photoshop 2026: update to version 27.11
- Photoshop 2025: update to version 26.11.8
Workaround
- No vendor workaround is known.
- Until the update is installed, do not open Photoshop files from untrusted or unexpected senders.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in this update.
- No public proof of concept found for this CVE.
- Not listed in the CISA Known Exploited Vulnerabilities catalog (per Strix). CISA SSVC: exploitation none, automatable no, technical impact total.
- Reported by Jony (jony_juice) per the Adobe acknowledgments.
Our recommendation
- Update Photoshop to 27.11 (2026) or 26.11.8 (2025) via the Creative Cloud desktop app, or deploy the update through the Admin Console in managed environments.
- Check the installed Photoshop versions on all workstations and close any gaps.
- Install the other fixes in the same bulletin (APSB26-158) at the same time.
- Instruct users not to open unexpected files from unknown senders.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-158 www.adobe.com
- ZDI: The October 2026 Security Update Review www.zerodayinitiative.com
- Strix: CVE-2026-95635 www.strix.ai
- Offseq Radar: CVE-2026-95635 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 00:03.
Original description (NVD)
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.