Security readout for executives and security teams
Plain-English summary
Adobe Photoshop Desktop 27.4 and earlier can be compromised when a user opens a specially crafted file. Successful exploitation could let an attacker run code with the user’s permissions, potentially exposing data, changing files, or disrupting the workstation.
Executive priority
Treat as a high-priority workstation update because compromise could affect all three security objectives. Prioritize creative, marketing, and production teams exposed to external files. User interaction reduces immediacy, but ordinary file-sharing workflows make the scenario credible.
Technical view
The flaw is an out-of-bounds read (CWE-125) in crafted-file parsing. Reading beyond an allocated memory structure may lead to code execution as the current user. CVSS 3.1 rates it 7.8: local attack vector, low complexity, no privileges required, user interaction required, and high confidentiality, integrity, and availability impacts.
Likely exposure
Exposure is concentrated on endpoints running Photoshop Desktop 27.4 or earlier, particularly where users open files from email, downloads, shared storage, or external collaborators. Systems without an affected Photoshop installation are not exposed through this vulnerability.
Exploitation context
Exploitation requires a victim to open a malicious file. The supplied evidence does not establish active exploitation, and the CVE is not identified as being in CISA’s Known Exploited Vulnerabilities catalog. No exploit availability information was provided.
Researcher notes
The source describes an out-of-bounds read during crafted-file parsing with potential code execution, but provides no vulnerable format, root-cause detail, proof of concept, or exploitation telemetry. Confirm remediation details directly against Adobe APSB26-40; do not infer unsupported detection signatures or affected products.
Mitigation direction
- Inventory Photoshop Desktop installations and identify versions 27.4 or earlier.
- Follow Adobe advisory APSB26-40 and deploy the vendor-approved fixed release.
- Prioritize users who routinely handle externally supplied creative files.
- Reinforce controls and guidance for opening untrusted or unexpected files.
Validation and detection
- Confirm installed Photoshop versions through endpoint or software inventory tools.
- Verify affected systems no longer run version 27.4 or earlier.
- Review deployment records for failed, deferred, or excluded updates.
- Monitor endpoint telemetry for suspicious activity following Photoshop file-open events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27289 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9adobeVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/photoshop/apsb26-40.htmlCVE reference, adobe · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.