Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-95635

Adobe Photoshop: double free can lead to remote code execution

Risk score
49/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.2%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
Adobe Photoshop
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Adobe PhotoshopTHE FLAWSTHE FIXCVE-2026-95635Double free can lead to remotecode executionCVSS 7.8 · EPSS 0%CVE-2026-95639Incorrect authorisation canlead to remote code executionCVSS 8.6 · EPSS 0%CVE-2026-95638Heap buffer overflow can leadto remote code executionCVSS 7.8 · EPSS 0%CVE-2026-83661Integer overflow can lead toremote code executionCVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedAdobe PhotoshopYELLOW · PLAN IT INAdobe PhotoshopPhotoshop Desktop is affectedby an Incorrect Authorizationvulnerability that could result inarbitrary code execution in thecontext of the current user. Anattacker could exploit thisvulnerability to execute…Where it standsNo known exploitationCONNECTS TOSame weaknessDouble free (CWE-415)36 other warnings in 30 days →Same productEarlier Adobe Photoshop warnings13 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Adobe Photoshop: Yellow, plan it in. Photoshop Desktop is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious…

The flaws

  • CVE-2026-95635: Double free can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-95639: Incorrect authorisation can lead to remote code execution (CVSS 8.6 · EPSS 0%)
  • CVE-2026-95638: Heap buffer overflow can lead to remote code execution (CVSS 7.8 · EPSS 0%)
  • CVE-2026-83661: Integer overflow can lead to remote code execution (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Adobe Photoshop

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.8 high

References

Original description

Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Last activity 13 Oct 2026. Patch Forecast updates every hour.