CVE-2024-34117
📋 TL;DR
This CVE describes a Use After Free vulnerability in Adobe Photoshop Desktop that could allow arbitrary code execution when a user opens a malicious file. The vulnerability affects Photoshop Desktop versions 24.7.3, 25.9.1 and earlier, requiring user interaction to exploit.
💻 Affected Systems
- Adobe Photoshop Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer in the context of the current user.
Likely Case
Malicious actor executes arbitrary code to install malware, steal data, or establish persistence on the victim's system.
If Mitigated
Limited impact if user doesn't open untrusted files and system has proper security controls like application sandboxing.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) and bypassing memory protections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Photoshop Desktop version 24.7.4 or 25.9.2
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb24-49.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to Apps tab. 3. Find Photoshop and click Update. 4. Restart Photoshop after update completes.
🔧 Temporary Workarounds
Restrict file opening
allConfigure Photoshop to only open files from trusted sources or disable opening of certain file types.
Application sandboxing
allRun Photoshop in a sandboxed environment to limit potential damage from exploitation.
🧯 If You Can't Patch
- Implement strict file handling policies - only open Photoshop files from trusted sources
- Use application control solutions to restrict Photoshop's execution capabilities
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version via Help > About Photoshop. If version is 24.7.3, 25.9.1 or earlier, system is vulnerable.Check Version:
Photoshop: Help > About PhotoshopVerify Fix Applied:
Verify Photoshop version is 24.7.4 or 25.9.2 or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Unexpected Photoshop crashes
- Photoshop opening unusual file types
- Process creation from Photoshop with suspicious parameters
Network Indicators:
- Outbound connections from Photoshop to unknown IPs after file opening
SIEM Query:
process_name:"Photoshop.exe" AND (event_type:crash OR file_path:contains:".psd" OR file_path:contains:".psb")