CVE-2024-52997
📋 TL;DR
Adobe Photoshop Desktop versions 26.0 and earlier contain a Use After Free vulnerability that could allow an attacker to execute arbitrary code on a victim's system. This requires the user to open a malicious file, potentially leading to full system compromise under the current user's privileges. All users running affected Photoshop versions are at risk.
💻 Affected Systems
- Adobe Photoshop Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with the attacker gaining the same privileges as the logged-in user, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to unauthorized access to sensitive files, system configuration changes, or installation of additional malware.
If Mitigated
Limited impact if user runs with minimal privileges, has application sandboxing, and avoids opening untrusted files.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code is currently available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 26.1 or later
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb24-101.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application
2. Navigate to 'Apps' section
3. Find Photoshop and click 'Update'
4. Restart Photoshop after update completes
🔧 Temporary Workarounds
Restrict file opening
allConfigure Photoshop to only open files from trusted sources or disable automatic file opening.
Run with reduced privileges
allRun Photoshop with standard user privileges instead of administrative rights to limit potential damage.
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Photoshop execution
- Use endpoint detection and response (EDR) tools to monitor for suspicious Photoshop behavior
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version via Help > About Photoshop. If version is 26.0 or earlier, system is vulnerable.Check Version:
On Windows: Check Photoshop version in Help > About. On macOS: Photoshop > About PhotoshopVerify Fix Applied:
Verify Photoshop version is 26.1 or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Unusual Photoshop process spawning child processes
- Photoshop accessing unexpected system resources
- Multiple failed file parsing attempts
Network Indicators:
- Photoshop making unexpected outbound network connections after file open
SIEM Query:
process_name:"photoshop.exe" AND (child_process_count > 3 OR network_connection_count > 5)