Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1030
_____________________________________________________________________

DATE                : 15/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Adobe Photoshop versions prior to
                                  27.11, 26.11.8.

====================================================================
https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html
_____________________________________________________________________

Adobe Security Bulletin
Last updated on Oct 13, 2026
Security update available for Adobe Photoshop | APSB26-158


Bulletin ID         Date published        Priority
APSB26-158          October 13, 2026      3


Summary
Adobe has released a priority 3 security update for Adobe Photoshop.
This update addresses vulnerabilities rated high and medium that
could result in arbitrary code execution and application
denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues
addressed in this update.


Affected Versions

Product                 Version              platform
Photoshop 2026          27.10 and earlier    Windows and macOS
Photoshop 2025          26.11.7 and earlier  Windows and macOS
Solution
Adobe categorizes this update with the following priority rating
and recommends users update their installation to the newest
version via the Creative Cloud desktop app's update mechanism.
For more information, please reference this help page.

For managed environments, IT administrators can use the Admin
Console to deploy Creative Cloud applications to end users.
Refer to this help page for more information.

Product       Updated version       Platform    Priority rating
Photoshop 2026  27.11       Windows and macOS   3
Photoshop 2025  26.11.8     Windows and macOS   3


Vulnerability Details


CVE-2026-95639
Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 8.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-104347
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-104346
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-100112
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-100111
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-97312
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-96523
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-83661
Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-96522
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-96521
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95641
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95638
Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95635
Vulnerability category: Double Free (CWE-415)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95637
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-104348
Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95636
Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Arbitrary code execution
Severity: High
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-95640
Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Medium
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2026-105896
Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Medium
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H


Acknowledgments
Adobe would like to thank the following researchers for reporting
the relevant issues and for working with Adobe to help protect
our customers:

Kieran (kaiksi) — CVE-2026-95639
yjdfy — CVE-2026-100112, CVE-2026-100111, CVE-2026-97312,
CVE-2026-96523, CVE-2026-96522, CVE-2026-96521, CVE-2026-95641
Brandon Evans of TrendAI Zero Day Initiative — CVE-2026-83661,
CVE-2026-95636
Jony (jony_juice) — CVE-2026-95638, CVE-2026-95635,
CVE-2026-95637, CVE-2026-104348, CVE-2026-104347,
CVE-2026-104346, CVE-2026-105896
ping (everping) — CVE-2026-95640
NOTE: Adobe maintains a public bug bounty program through Intigriti.
If you’re an external security researcher interested in identifying
and responsibly reporting potential security vulnerabilities to
Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories
or email PSIRT@adobe.com.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================