Cyber Resilience

CVE-2023-44330

Memory Safety in Adobe Photoshop ≤ 24.7.1

Published
16 November 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0032 24th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2023-44330 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Photoshop. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…

more

a victim must open a malicious file.

CWE(s)

Related Threats

CVEs Like This One

CVE-2024-45108Same product: Adobe Photoshop
CVE-2024-43760Same product: Adobe Photoshop
CVE-2024-45109Same product: Adobe Photoshop
CVE-2023-21575Same product: Adobe Photoshop
CVE-2023-21576Same product: Adobe Photoshop
CVE-2025-27198Same product: Adobe Photoshop
CVE-2023-22230Same product: Apple Macos
CVE-2023-21595Same product: Apple Macos
CVE-2025-21130Same product: Apple Macos
CVE-2024-45150Same product: Apple Macos

Affected Assets

adobe
photoshop
≤ 24.7.1 · ≤ 25.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.

ID.RA-01 partial match
prevents

Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.

PR.PS-02 partial match
prevents

Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development and acceptance can detect and prevent out-of-bounds write defects.

prevents

Secure development life cycle mandates practices that prevent out-of-bounds writes.

prevents

Application security requirements can specify bounds-checking and safe memory handling.

prevents

Secure architecture and engineering principles reduce the likelihood of buffer overflows.

prevents

Secure coding directly addresses out-of-bounds writes through language choice and coding standards.

prevents

Change management can enforce review gates that catch unsafe memory operations before deployment.

References