CVE-2021-21048
📋 TL;DR
CVE-2021-21048 is a memory corruption vulnerability in Adobe Photoshop that allows arbitrary code execution when a user opens a specially crafted malicious file. Attackers can exploit this to run malicious code with the victim's user privileges. All users running vulnerable versions of Photoshop are affected.
💻 Affected Systems
- Adobe Photoshop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation leading to data exfiltration, credential theft, or system disruption for individual users who open malicious Photoshop files.
If Mitigated
Limited impact with proper security controls like application whitelisting, least privilege accounts, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code was available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Photoshop 21.2.5 and 22.2
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to 'Apps' tab. 3. Find Photoshop and click 'Update'. 4. Restart Photoshop after update completes.
🔧 Temporary Workarounds
Disable Photoshop file opening
allTemporarily prevent Photoshop from opening files by modifying file associations or using application control policies.
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized Photoshop execution
- Use least privilege accounts and disable Photoshop for non-essential users
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version via Help > About Photoshop in the application menu.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Photoshop\[Version]\PluginVersion. On macOS: Check /Applications/Adobe Photoshop [Version]/Adobe Photoshop [Version].app/Contents/Info.plistVerify Fix Applied:
Verify Photoshop version is 21.2.5 or higher (for 21.x) or 22.2 or higher (for 22.x).📡 Detection & Monitoring
Log Indicators:
- Photoshop crash logs with memory access violations
- Unexpected Photoshop process spawning child processes
Network Indicators:
- Outbound connections from Photoshop process to suspicious IPs
SIEM Query:
Process creation where parent process contains 'photoshop' AND (child process contains 'cmd' OR 'powershell' OR 'wscript')