CVE-2026-27289

CVE-2026-27289 is an out-of-bounds read vulnerability affecting Adobe Photoshop Desktop versions 27.4 and earlier that occurs during the parsing of maliciously crafted files. The flaw allows attackers to read beyond allocated memory boundaries, potentially enabling arbitrary code execution within the context of the current user. Exploitation requires user interaction, as victims must be tricked into opening a malicious file. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege requirements. The impact is severe, providing attackers with high-level confidentiality, integrity, and availability compromises. The EPSS score of 0.000270 indicates this threat is currently perceived as having minimal exploitation probability relative to the broader CVE landscape. As of the current assessment, this vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and shows no active exploitation in the wild. No public exploit code appears to be readily available, and community attention remains limited. Organizations should prioritize patching to versions above 27.4, though immediate risk is currently low given the lack of active exploitation.