Adobe Photoshop: RCE via DICOM JPEG (CVE-2026-75862) Patched in APSB26-130

Adobe has fixed a remote code execution vulnerability in Photoshop today caused by an integer overflow in the parsing of DICOM JPEG images. The flaw, tracked as CVE-2026-75862 and reported on June 26 by Brandon Evans of the TrendAI Zero Day Initiative, affects versions 2026 27.6 and earlier, as well as 2025 26.11.6 and earlier on Windows and macOS. The notable detail: the target format is DICOM, the medical standard for diagnostic imaging, not a traditional creative format — a signal of how attack surfaces extend beyond industry boundaries.

The Mechanism: Integer Overflow in DICOM Parsing

The specific flaw resides in the parser Photoshop uses to process image data in DICOM JPEG format. According to advisory ZDI-26-679, the lack of validation of user-supplied data triggers an integer overflow that precedes buffer allocation. This deviation allows corruption of adjacent memory and, from there, arbitrary code execution in the context of the Photoshop process.

The chain is linear: specially crafted DICOM JPEG file → opened in Photoshop → overflow during parsing → memory corruption → malicious code execution. The user interaction requirement — opening the file or navigating to a page that serves it — lowers the risk profile compared to a wormable vulnerability, but does not eliminate it: the vector remains practical via social engineering.

The Medical-Creative Intersection as Attack Surface

DICOM (Digital Imaging and Communications in Medicine) is the global standard for distribution, viewing, and storage of medical images. Its presence in Photoshop is not marginal: Adobe integrated DICOM support to allow photographers, designers, and healthcare professionals to open and manipulate X-rays, CT scans, and MRIs within the same creative workflow.

This functional convergence, however, expands the attack surface transversally. A healthcare professional receiving a purported diagnostic image via email, or a designer working on materials for the medical sector, could open the file with the same confidence — and the same software — used for a RAW or PSD. The DICOM JPEG parser is the same entry point as a creative JPEG, but its "technical" provenance makes it less suspicious to the user and, often, to security filters.

Coordinated Disclosure: 76 Days

The timeline reveals disciplined vulnerability management. Private vendor notification occurred on June 26, 2026; coordinated public release was set for September 10, 2026, a 76-day interval. This window allowed Adobe to prepare and distribute update APSB26-130 before full technical disclosure.

Brandon Evans, a researcher with TrendAI Zero Day Initiative, is credited with the discovery. His attribution confirms ZDI's role as a collection node for zero-day vulnerabilities before they reach coordinated publication. The fact that Adobe reports no in-the-wild exploits at release does not preclude proof-of-concept code emerging in the coming days: the ZDI advisory describes the mechanism with sufficient precision to guide an experienced reverse engineer.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." — ZDI-26-679 advisory

What to Do Now

Adobe has made update APSB26-130 available to fix the vulnerability. Priority actions are as follows:

1. Verify the installed Photoshop version: if it is 2026 27.6 or earlier, or 2025 26.11.6 or earlier, apply the update as soon as possible via the Adobe Creative Cloud desktop app or enterprise distribution channels.
2. Treat incoming DICOM JPEG files from external sources with the same caution reserved for generic attachments: do not open them in Photoshop before verifying their origin and integrity.
3. Monitor Photoshop execution logs on sensitive workstations for crash anomalies or abnormal behavior when opening image files, which could indicate exploitation attempts.
4. Review automatic update policies for creative software in enterprise environments, reducing the time window between patch release and actual deployment.

Dossier Gaps and Verification Points

The dossier does not specify the exact version number that fixes the vulnerability, indicating only the "newest version." It also does not clarify whether the flaw is exploitable exclusively via local file or also through the browser, nor whether a public proof-of-concept exists. The exact extent of the memory deviation — address, size of the compromised buffer — is not documented in available sources.

These gaps are relevant for operational risk assessment: an enterprise managing Photoshop workstations in healthcare or medical communications environments cannot calibrate compensating controls without knowing whether the primary vector is email, web, or both.

Why This Vulnerability Signals a Broader Trend

The lesson of CVE-2026-75862 goes beyond a single product. When mainstream software absorbs vertical formats — medical, industrial, scientific — it inherits the vulnerabilities of that ecosystem without inheriting its defense culture. The DICOM parser in Photoshop was not designed to withstand a hostile threat model; it was designed to open files. Security became a retroactive requirement, not a structural one.

For security editors, the news is a wake-up call on similar integrations: CAD in consumer viewers, industrial protocols in mobile apps, scientific formats in cloud platforms. Every bridge between domains is potentially an unguarded trench.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-679/
• https://www.cve.org/CVERecord?id=CVE-2026-75862
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://helpx.adobe.com/security/products/photoshop/apsb26-130.html
• https://www.trendmicro.com/

Information verified against cited sources and current as of publication.

Sources