CVE-2021-21050
📋 TL;DR
CVE-2021-21050 is an out-of-bounds read vulnerability in Adobe Photoshop that allows arbitrary code execution when a user opens a malicious file. Attackers can exploit this to run code with the victim's privileges, potentially compromising their system. All users running vulnerable versions of Photoshop are affected.
💻 Affected Systems
- Adobe Photoshop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise and potential lateral movement within the network.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions preventing system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Photoshop 21.2.5 and 22.2
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb21-10.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to 'Apps' tab. 3. Find Photoshop and click 'Update'. 4. Restart Photoshop after update completes.
🔧 Temporary Workarounds
Disable Photoshop file opening
allTemporarily prevent Photoshop from opening files via registry/plist modification
Windows: reg add "HKLM\SOFTWARE\Classes\.psd" /ve /d "txtfile" /f
macOS: defaults write com.apple.LaunchServices LSHandlers -array-add '{LSHandlerContentType=public.image;LSHandlerRoleAll=com.apple.Preview;}'
🧯 If You Can't Patch
- Implement application whitelisting to block unauthorized Photoshop execution
- Use network segmentation to isolate Photoshop workstations from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version via Help > About Photoshop in application menuCheck Version:
Photoshop: Help > About Photoshop (GUI only)Verify Fix Applied:
Verify version is 21.2.5 or higher (for 21.x) or 22.2 or higher (for 22.x)📡 Detection & Monitoring
Log Indicators:
- Photoshop crash logs with memory access violations
- Windows Event Logs showing Photoshop process termination
Network Indicators:
- Unusual outbound connections from Photoshop process post-file opening
SIEM Query:
process_name:"photoshop.exe" AND (event_id:1000 OR event_id:1001) AND description:"access violation"