Double Free Vulnerability in Photoshop Desktop Allows Arbitrary Code Execution

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Adobe Systems Incorporated

Description

Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95635

Affected Vendors & Products

Vendor	Product	Version / Range
Adobe	Photoshop	0
Adobe	Photoshop	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-415	The product calls free() twice on the same memory address.

Attack-Flow Graph

Executive Summary

This is a Double Free vulnerability in Adobe Photoshop Desktop. It allows arbitrary code execution in the context of the current user by exploiting a flaw where memory is freed twice. Exploitation requires user interaction, such as opening a malicious file.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run arbitrary code on your system. This could lead to unauthorized access, data theft, or installation of malware. Since it requires user interaction, opening a malicious file is necessary for exploitation.

Mitigation Strategies

Update Adobe Photoshop to the latest version as soon as patches are available to address the Double Free vulnerability.

Hi! I’m here to help you understand CVE-2026-95635. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70