CVE-2021-36005
📋 TL;DR
CVE-2021-36005 is a stack overflow vulnerability in Adobe Photoshop that allows arbitrary code execution when a user opens a malicious PSD file. Affected users include anyone running Photoshop versions 21.2.9 or earlier, or 22.4.2 or earlier. The attacker must trick the user into opening a crafted PSD file.
💻 Affected Systems
- Adobe Photoshop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation leading to malware installation, data exfiltration, or persistence mechanisms on the affected workstation.
If Mitigated
Limited impact with proper application whitelisting and user training preventing malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Photoshop 21.2.10 and 22.4.3
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb21-63.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to 'Apps' tab. 3. Find Photoshop and click 'Update'. 4. Restart Photoshop after update completes.
🔧 Temporary Workarounds
Disable PSD file association
allPrevent Photoshop from automatically opening PSD files by changing file associations
Windows: Control Panel > Default Programs > Associate a file type or protocol with a program
macOS: Right-click PSD file > Get Info > Open With > Change
🧯 If You Can't Patch
- Implement application whitelisting to block execution of unsigned PSD files
- Train users to never open PSD files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version in Help > About Photoshop. If version is 21.2.9 or earlier, or 22.4.2 or earlier, system is vulnerable.Check Version:
Photoshop: Help > About PhotoshopVerify Fix Applied:
Verify Photoshop version is 21.2.10 or later for version 21.x, or 22.4.3 or later for version 22.x.📡 Detection & Monitoring
Log Indicators:
- Application crashes in Photoshop with PSD file handling
- Unexpected process creation from Photoshop.exe
Network Indicators:
- Outbound connections from Photoshop process to unknown IPs after file open
SIEM Query:
Process Creation where Image contains 'photoshop.exe' and CommandLine contains '.psd'