Adobe Photoshop vulnerabilities

118 CVEs affecting Adobe Photoshop, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97312, published 2026-10-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2007-2365, published 2007-04-30. High severity, CVSS 9.3. EPSS: 41.2% chance of exploitation in the next 30 days. Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
CVE-2007-2244, published 2007-04-25. High severity, CVSS 9.3. EPSS: 31.7% chance of exploitation in the next 30 days. Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) BMP, (2) DIB, or (3) RLE file.
CVE-2011-2131, published 2011-08-11. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted…
CVE-2008-1765, published 2008-04-23. High severity, CVSS 9.3. EPSS: 20% chance of exploitation in the next 30 days. Buffer overflow in Adobe Photoshop Album Starter Edition 3.2, and possibly After Effects CS3, allows user-assisted remote attackers and physically proximate attackers to execute arbitrary code via a…
CVE-2010-3127, published 2010-08-26. High severity, CVSS 9.3. EPSS: 13.9% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan…
CVE-2012-2027, published 2012-05-09. High severity, CVSS 9.3. EPSS: 13.3% chance of exploitation in the next 30 days. Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via a crafted TIFF (aka .TIF) file.
CVE-2017-11303, published 2017-12-09. Critical severity, CVSS 9.8. EPSS: 8.1% chance of exploitation in the next 30 days. An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable memory corruption vulnerability exists. Successful exploitation could lead to arbitrary code…
CVE-2021-21051, published 2021-02-11. High severity, CVSS 7.8. EPSS: 7.4% chance of exploitation in the next 30 days. Adobe Photoshop versions 21.2.4 (and earlier) and 22.1.1 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted javascript file. An unauthenticated attacker…
CVE-2017-11304, published 2017-12-09. Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days. An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. An exploitable use-after-free vulnerability exists. Successful exploitation could lead to arbitrary code execution.
CVE-2012-2028, published 2012-05-09. High severity, CVSS 9.3. EPSS: 7% chance of exploitation in the next 30 days. Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to execute arbitrary code via unspecified vectors.

Latest

CVE-2026-97312, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-96523, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-96522, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-96521, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-95641, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-95640, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application,…
CVE-2026-95639, published 2026-10-13. High severity, CVSS 8.6. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this…
CVE-2026-95638, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-95637, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-95636, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires…