Security update available for Adobe Photoshop | APSB26-158
Bulletin ID
Date published
Priority
APSB26-158
October 13, 2026
3
style
grid width 12
Summary
Adobe has released a priority 3 security update for Adobe Photoshop. This update addresses vulnerabilities rated high and medium that could result in arbitrary code execution and application denial-of-service.
Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.
Affected Versions
Product
Version
Platform
Photoshop 2026
27.10 and earlier
Windows and macOS
Photoshop 2025
26.11.7 and earlier
Windows and macOS
style
grid width 12
Solution
Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism. For more information, please reference this help page.
For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.
Product
Updated version
Platform
Priority rating
Photoshop 2026
27.11
Windows and macOS
3
Photoshop 2025
26.11.8
Windows and macOS
3
style
grid width 12
Vulnerability Details
Vulnerability category: Incorrect Authorization (CWE-863) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 8.2 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Integer Overflow or Wraparound (CWE-190) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Heap-based Buffer Overflow (CWE-122) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Double Free (CWE-415) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Out-of-bounds Write (CWE-787) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Heap-based Buffer Overflow (CWE-122) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: Integer Overflow or Wraparound (CWE-190) Vulnerability impact: Arbitrary code execution Severity: High CVSS base score: 7.8 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability category: NULL Pointer Dereference (CWE-476) Vulnerability impact: Application denial-of-service Severity: Medium CVSS base score: 5.5 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability category: NULL Pointer Dereference (CWE-476) Vulnerability impact: Application denial-of-service Severity: Medium CVSS base score: 5.5 CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Acknowledgments
Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:
NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage and local shared objects, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
General information
You can control how Adobe websites use cookies and similar technologies by making choices below. But note that if you disable cookies and similar technologies entirely, Adobe websites may not function properly.
Cookies are small text files stored by your web browser when you use websites. There are also other technologies that can be used for similar purposes like HTML5 Local Storage, web beacons, and embedded scripts. These technologies help us do things like remembering you and your preferences when you return to our sites, measure how you use the website, conduct market research, and gather information about the ads you see and interact with.
You can make choices in the menu below about what cookies and other technologies you want us to use on Adobe sites when you visit them from this browser. You can always change those choices later by clicking on the Cookie Preferences link at the bottom of the page.
If enabled:
We can improve your experience by tailoring the site and the content to things we think might be of interest
We can better keep track of your preferences — like what language you prefer to use
We will better understand your likely interests so we can provide you more relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
It will help us improve the performance of our website and those of our partners who use the Adobe Experience Cloud
If disabled:
We won’t be able to remember you from session to session so the experience may not be tailored to your interests
We’ll still count your use of our site and services
You’ll still have access to the content of the site but certain features that depend on cookies may not function
You’ll still see ads, they just may not be as relevant to you
Operate the site and core servicesOperate site and measure engagement
Always active
These cookies are required, and they are used to enable the site and related services core functionality. Without them the site could not operate, so they cannot be disabled.
These cookies enable the site and related services’ core functionality and collect statistics about user engagement, such as counting active use to help us understand trends. These cookies cannot be disabled.
Measure performance
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued and how often unique visitors return to the site, making it hard to improve information we offer to you.
These cookies are used to analyze site usage to measure and improve performance. Without them Adobe cannot know what content is most valued, making it hard to improve information we offer to you.
Extend functionality
These cookies are used to enhance the functionality of Adobe sites such as remembering your settings and preferences to deliver a personalized experience; for example, your username, your repeated visits, preferred language, your country, or any other saved preference.
Personalize advertising
These cookies are used to enable Adobe and our partners to serve ads more relevant to your interests. Without them you will still see ads, but they might not be as relevant to you.
