.

Adobe Security Bulletin

Last updated on Sep 8, 2026

Security update available for Adobe Photoshop | APSB26-130

Bulletin ID
Date published
Priority
APSB26-130
September 8, 2026
3
style
grid width 12

Summary

Adobe has released an update for Photoshop for Windows and macOS. This update resolves critical vulnerabilities that could result in arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product
Affected version
Platform
Photoshop 2026
27.6 and earlier
Windows and macOS
Photoshop 2025
26.11.6 and earlier
Windows and macOS
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, please reference this help page.

Product
Updated versions
Platform
Priority
Photoshop 2026
27.7
Windows and macOS
3
Photoshop 2025
26.11.7
Windows and macOS
3
style
grid width 12

Note

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Vulnerability Details

Vulnerability category
Vulnerability impact
Severity
CVSS base score
CVSS vector
CVE number
Uncontrolled Search Path Element (CWE-427)
Arbitrary code execution
Critical
8.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2026-76199
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-82007
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-82006
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-75631
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-82005
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-75863
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-75862
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-75771

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style
xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments

Adobe would like to thank the following researcher for reporting this issue and for working with Adobe to help protect our customers:

  • Kieran (kaiksi) — CVE-2026-76199
  • yjdfy — CVE-2026-82007, CVE-2026-75631
  • Jony (jony_juice) — CVE-2026-82006, CVE-2026-82005
  • Brandon Evans of TrendAI Zero Day Initiative — CVE-2026-75863, CVE-2026-75862, CVE-2026-75771

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle
APSB26-130
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-09-08
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/photoshop
Arbitrary
search: CVE-2026-76199 CVE-2026-82007 CVE-2026-82006 CVE-2026-75631 CVE-2026-82005 CVE-2026-75863 CVE-2026-75862 CVE-2026-75771