Adobe Photoshop Vulnerable to RCE via DCM Pixel Data Parsing Flaw
A critical integer overflow vulnerability in Adobe Photoshop's DCM pixel data parsing allows for remote code execution.
Adobe Photoshop is facing a significant security threat due to a newly disclosed remote code execution (RCE) vulnerability. The flaw, identified as ZDI-26-778 and tracked under CVE-2026-95636, resides within the application's handling of DICOM image data. This vulnerability carries a CVSS score of 7.8, indicating a high level of severity.
The vulnerability stems from an integer overflow that occurs during the parsing of DICOM pixel data. Attackers can exploit this by providing malformed input, which leads to an improper buffer allocation before the data is fully processed. This oversight allows an attacker to potentially execute arbitrary code within the context of the current Photoshop process.
Exploitation of this vulnerability requires user interaction. This typically involves tricking a user into opening a specially crafted malicious DICOM file or, in some scenarios, visiting a web page designed to trigger the vulnerability through embedded content. The need for user interaction, while a barrier, does not diminish the potential impact of a successful exploit.
Adobe has acknowledged the vulnerability and has released a security update to address it. Users are strongly advised to apply the patch, detailed in APSB26-158, as soon as possible to protect their systems. The prompt patching by Adobe is crucial in mitigating the risk of widespread exploitation.
The vulnerability was initially reported to Adobe on August 7, 2026, by Brandon Evans of TrendAI Zero Day Initiative. Following a coordinated disclosure process, the advisory was publicly released on October 15, 2026, with an update to the advisory also published on the same day. This timeline reflects a standard practice for responsible vulnerability disclosure.
While the specific threat actors or campaigns leveraging this vulnerability are not yet publicly detailed, the nature of RCE flaws means they are prime targets for both opportunistic attackers and targeted intrusions. The widespread use of Adobe Photoshop across creative industries and general users makes this a potentially impactful vulnerability.
This discovery underscores the ongoing challenges in securing complex software like Adobe Photoshop, which often handle a wide variety of file formats and data types. Vulnerabilities in parsing these formats remain a persistent attack vector, requiring continuous vigilance from both vendors and users.
Users should ensure their Adobe Photoshop installations are updated to the latest version to incorporate the security fixes. Beyond patching, maintaining good security hygiene, such as being cautious with unsolicited files and links, remains a critical layer of defense against such threats.
This advisory details a specific integer overflow vulnerability (CVE-2026-83661) within Adobe Photoshop's JPEG parsing component in PDF files, distinct from the previously reported DCM pixel data parsing flaw. The new vulnerability also requires user interaction and allows for remote code execution, but the technical mechanism and affected component differ.