CVE-2025-21122
📋 TL;DR
Adobe Photoshop Desktop versions 25.12, 26.1 and earlier contain an integer underflow vulnerability that could allow arbitrary code execution when a user opens a malicious file. This affects all users running vulnerable versions of Photoshop on any operating system.
💻 Affected Systems
- Adobe Photoshop Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration through crafted Photoshop files sent via email or downloaded from untrusted sources.
If Mitigated
Limited impact if user follows security best practices and doesn't open untrusted files, with potential for application crash.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Photoshop 25.13 or 26.2 or later
Vendor Advisory: https://helpx.adobe.com/security/products/photoshop/apsb25-02.html
Restart Required: No
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to Apps tab. 3. Find Photoshop and click Update. 4. Alternatively, download latest version from Adobe website.
🔧 Temporary Workarounds
Restrict Photoshop file types
allBlock or quarantine .psd and other Photoshop file types from untrusted sources
User awareness training
allTrain users not to open Photoshop files from unknown or untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to restrict Photoshop execution to trusted directories only
- Deploy endpoint protection with behavioral analysis to detect malicious file execution attempts
🔍 How to Verify
Check if Vulnerable:
Check Photoshop version in Help > About Photoshop. If version is 25.12 or earlier, or 26.1 or earlier, system is vulnerable.Check Version:
On Windows: wmic product where name="Adobe Photoshop" get version. On macOS: /Applications/Adobe\ Photoshop\ */Adobe\ Photoshop.app/Contents/Info.plist | grep -A1 CFBundleShortVersionStringVerify Fix Applied:
Verify Photoshop version is 25.13 or later for version 25.x, or 26.2 or later for version 26.x.📡 Detection & Monitoring
Log Indicators:
- Photoshop crash logs with memory access violations
- Unexpected child processes spawned from Photoshop
Network Indicators:
- Unusual outbound connections from Photoshop process
SIEM Query:
process_name:"photoshop.exe" AND (event_id:1000 OR parent_process_name:"photoshop.exe")