Adobe Photoshop Vulnerable to Remote Code Execution via JPEG Parsing Flaw
A critical integer overflow vulnerability in Adobe Photoshop's DCM JPEG image parsing allows remote code execution, requiring only user interaction with a malicious file or webpage.
Zero Day Initiative (ZDI) has disclosed a critical remote code execution vulnerability affecting Adobe Photoshop, identified as ZDI-26-679 and assigned CVE-2026-75862. The flaw resides within the software's handling of DICOM image data, specifically during the parsing of DCM JPEG files. Attackers can exploit this vulnerability by tricking unsuspecting users into opening a specially crafted malicious image file or by directing them to a webpage that hosts such a file.
The vulnerability stems from an integer overflow that occurs before a buffer is allocated, due to improper validation of user-supplied data within the DCM JPEG parsing component. Successful exploitation allows an attacker to execute arbitrary code on the affected system, operating within the context of the current Photoshop process. This could lead to a complete compromise of the user's machine, depending on their privileges.
With a CVSS score of 7.8, this vulnerability is rated as high severity. While user interaction is a prerequisite for exploitation, the ease with which malicious files can be distributed via email, social media, or compromised websites makes this a significant threat. Adobe Photoshop is a widely used professional graphics editing tool, meaning a large number of users could potentially be at risk.
Adobe has acknowledged the vulnerability and has released security updates to address it. Users are strongly advised to update their Photoshop installations to the latest version to mitigate the risk. The advisory from Adobe, APSB26-130, provides further details on the affected versions and the patching process. The disclosure timeline indicates a coordinated public release on September 10, 2026, following the vendor's initial report on June 26, 2026.
This vulnerability highlights a recurring theme in software security: the dangers of complex file parsing without rigorous input validation. Image formats, especially those with embedded metadata or specialized structures like DICOM, often present unique challenges for developers. Integer overflows and buffer overflows remain common exploit primitives, as they can be leveraged to overwrite critical memory regions and gain control of program execution.
The discovery and responsible disclosure of this vulnerability by Brandon Evans of TrendAI Zero Day Initiative underscore the importance of independent security research. By identifying and reporting such flaws, researchers help vendors patch their software before malicious actors can exploit them, thereby protecting users and the broader digital ecosystem.
While the specific impact on enterprise environments will depend on deployment configurations and user practices, the potential for widespread compromise necessitates prompt patching. Organizations should prioritize updating all instances of Adobe Photoshop and ensure that their security policies include regular software updates and user awareness training regarding malicious file handling.
The Zero Day Initiative advisory ZDI-26-677 provides further technical details on this vulnerability, assigning it the CVE identifier CVE-2026-75771. It specifies that the flaw lies within the parsing of DICOM image data, stemming from improper validation leading to an integer overflow before buffer allocation. The advisory also credits Brandon Evans of TrendAI Zero Day Initiative for the discovery.
This new advisory from Zero Day Initiative details a specific integer overflow vulnerability, CVE-2026-75863, within Adobe Photoshop's DCM file parsing. While the existing story broadly covers a JPEG parsing flaw, this update pinpoints the DCM format and provides a specific CVE identifier, along with details on the vulnerability's mechanism and Adobe's patch release.