CVE-2026-27289
Published: 14 April 2026
Summary
CVE-2026-27289 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Adobe Photoshop. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of known vulnerabilities like this out-of-bounds read by applying vendor patches from Adobe's security bulletin.
Implements memory protection mechanisms such as DEP and ASLR to minimize successful exploitation of out-of-bounds read memory flaws.
Enables scanning to identify systems running vulnerable Photoshop versions affected by this file parsing flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read during crafted file parsing directly enables arbitrary code execution on open (T1203 Exploitation for Client Execution) after user interaction with a malicious file (T1204.002).
NVD Description
Photoshop Desktop versions 27.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute…
more
code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Deeper analysisAI
CVE-2026-27289 is an out-of-bounds read vulnerability (CWE-125) affecting Adobe Photoshop Desktop versions 27.4 and earlier. The flaw occurs when parsing a crafted file, which could result in a read past the end of an allocated memory structure. Published on 2026-04-14, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
An attacker can exploit this vulnerability by tricking a victim into opening a malicious file, requiring local access and user interaction. Successful exploitation allows arbitrary code execution in the context of the current user, potentially leading to high-impact compromise of confidentiality, integrity, and availability.
Adobe's security bulletin APSB26-40 at https://helpx.adobe.com/security/products/photoshop/apsb26-40.html provides details on mitigations and patches.
Details
- CWE(s)