CVE-2026-75862: Adobe Photoshop DCM JPEG Integer Overflow (ZDI-26-679) — Detection and Remediation Guide

Zero Day Initiative has published advisory ZDI-26-679 disclosing CVE-2026-75862, an integer overflow vulnerability in Adobe Photoshop's DCM (DICOM) JPEG image parsing code. The flaw carries a CVSS score of 7.8 (High) and allows remote attackers to execute arbitrary code in the context of the current user when a victim opens a malicious file or visits a malicious page that delivers a crafted image.

This is a classic client-side file-parsing bug in one of the most widely deployed creative applications on the planet. Photoshop is installed across marketing teams, design agencies, media production houses, healthcare imaging-adjacent workflows, and enterprise creative suites — populations that routinely receive files from external, untrusted sources (freelancers, stock asset sites, client deliverables). That makes this vulnerability a high-value initial access vector for phishing and watering-hole operations, despite the user-interaction requirement.

Why act now: ZDI advisories are published after coordinated disclosure, which means the technical research community — and offensive tooling authors — now have enough metadata (component, bug class, file format) to begin reverse-engineering a working exploit. File-parsing integer overflows in image decoders are a well-trodden exploitation path, and the delta between advisory publication and in-the-wild PoC for this bug class has historically been short. If Photoshop exists anywhere in your estate, treat this as a priority patch item.

Technical Analysis

Vulnerability Summary

Affected Component and Attack Chain

The vulnerability resides in Photoshop's handling of JPEG data embedded within DCM/DICOM image files (.dcm). DICOM is the medical imaging standard, but Photoshop ships a DICOM parser for opening these files directly — a parser that processes attacker-controlled binary input with native code.

From a defender's perspective, the attack chain looks like this:

1. Delivery: Attacker delivers a crafted .dcm file via phishing attachment, malicious download link, cloud file share, or a drive-by page that triggers a download the user subsequently opens in Photoshop.
2. Parse: Photoshop's DICOM plugin parses the embedded JPEG stream. Malformed length/dimension fields trigger an integer overflow during size calculation for an allocation.
3. Corruption: The overflowed (undersized) allocation is followed by an oversized copy/decode operation, producing a heap corruption condition the attacker can shape.
4. Execution: Controlled corruption is leveraged to hijack execution flow, yielding code execution as the user running Photoshop — no elevation of privilege is built into the bug itself, but the attacker lands a foothold with the victim's token, mapped drives, and credentials in memory.

Exploitation Requirements

• The victim must open the malicious .dcm file in Photoshop (or, per ZDI, visit a malicious page that results in the file being processed).
• No authentication, no elevated privileges, no additional conditions on the attacker's side.
• The attacker needs to know or guess the target uses Photoshop — trivial via phishing lures aimed at creative or healthcare roles, or via waterholing design asset sites.

Exploitation Status

As of this writing, ZDI-26-679 is a coordinated disclosure — there is no confirmed in-the-wild exploitation and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. No public PoC has been observed. That is exactly the window where patching is cheapest. Once a reliable exploit primitive is published for a mainstream image parser, weaponization into phishing kits typically follows in days-to-weeks.

Detection & Response

Because the vulnerability triggers inside Photoshop's own process, you will not see a signature network or log event at the moment of the overflow. The highest-fidelity detections focus on what happens after exploitation succeeds: Photoshop — an application that should never spawn shells, script interpreters, or LOLBins — suddenly doing exactly that. Secondary detections target the delivery vector: suspicious .dcm files landing in user-writable locations outside of legitimate medical imaging workflows.

Sigma Rules

---
title: Adobe Photoshop Spawning Suspicious Child Process
id: 3f9c1a72-8b4d-4e6f-b2a7-5c1d8e9f0a3b
status: experimental
description: Detects Adobe Photoshop spawning command interpreters, script engines, or LOLBins. Consistent with post-exploitation activity following a file-parsing exploit such as CVE-2026-75862 (ZDI-26-679 DCM JPEG integer overflow).
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-679/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Photoshop.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\msbuild.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare third-party Photoshop plugins invoking external tools; baseline per-host before enforcing
level: high
---
title: Suspicious DCM File Creation in User-Writable Locations
id: 8a2e4d61-3c7b-4f5a-9d1e-6b0c2f4a7e9d
status: experimental
description: Detects creation of DICOM (.dcm) files in Downloads, Temp, or AppData locations by non-medical-imaging processes. Delivery vector for CVE-2026-75862 Photoshop DCM JPEG parsing exploit via phishing or drive-by download.
references:
  - https://www.zerodayinitiative.com/advisories/ZDI-26-679/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1204.002
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Temp\'
  selection_ext:
    TargetFilename|endswith: '.dcm'
  filter_medical:
    Image|contains:
      - '\Program Files\'
      - 'RadiAnt'
      - 'OsiriX'
      - 'Horos'
      - 'PACS'
  condition: selection_path and selection_ext and not filter_medical
falsepositives:
  - Legitimate DICOM files downloaded by medical staff; scope to non-clinical endpoints or add organizational allowlists
level: medium

KQL — Microsoft Sentinel / Defender

The primary hunt looks for Photoshop launching child processes consistent with post-exploitation. The secondary query surfaces .dcm file delivery events on endpoints with Photoshop installed. Tune the child-process list against your own baseline of legitimate Photoshop plugins over 30 days before enabling alerting.

// Hunt 1: Photoshop spawning suspicious child processes (post-exploitation behavior, CVE-2026-75862)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "photoshop.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
                      "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "certutil.exe",
                      "bitsadmin.exe", "curl.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, SHA256, FolderPath
| order by TimeGenerated desc;

// Hunt 2: .dcm file creation in user-writable paths by browsers or mail clients (delivery vector)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".dcm"
| where FolderPath has_any ("\\Downloads\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\")
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "outlook.exe", "thunderbird.exe")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, FolderPath,
          InitiatingProcessFileName, SHA256
| order by TimeGenerated desc;

Velociraptor VQL

Use this artifact for live triage on endpoints where a user reports opening a suspicious image file, or where the Sigma/KQL detections above fired. It correlates running Photoshop processes with suspicious children and enumerates recently created .dcm files in user profile paths.

-- Triage Photoshop exploitation indicators: suspicious children + recent .dcm artifacts
SELECT * FROM
{
  -- Suspicious child processes of Photoshop
  SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
  FROM pslist()
  WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)photoshop')
    AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|certutil|curl)\.exe'
}
UNION ALL
{
  -- Recently created .dcm files in user-writable locations
  SELECT 0 AS Pid, 0 AS Ppid, 'FILE' AS Name,
         FullPath AS CommandLine, FullPath AS Exe,
         '' AS Username, Mtime AS CreateTime
  FROM glob(globs=['C:/Users/*/Downloads/*.dcm',
                   'C:/Users/*/AppData/Local/Temp/*.dcm',
                   'C:/Users/*/AppData/Roaming/**/*.dcm'])
  WHERE Mtime > now() - 1209600  -- last 14 days
}

Remediation / Verification Script

This PowerShell script inventories installed Photoshop versions across the machine, flags any instance, confirms the Adobe Creative Cloud updater service state, and audits for recent .dcm files in user-writable locations that warrant analyst review. Run it via your RMM or as an Intune remediation detection script.

# CVE-2026-75862 / ZDI-26-679 — Photoshop DCM JPEG Integer Overflow
# Inventory, update-readiness check, and delivery-vector audit

$report = [ordered]@{}

# 1. Enumerate installed Photoshop versions
$photoshop = Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*,
                              HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*,
                              HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue |
             Where-Object { $_.DisplayName -match 'Adobe Photoshop' } |
             Select-Object DisplayName, DisplayVersion, InstallLocation
$report.PhotoshopInstalls = $photoshop

if ($photoshop) {
    Write-Host "[ALERT] Photoshop detected — verify against the patched build in the Adobe security bulletin for CVE-2026-75862:" -ForegroundColor Yellow
    $photoshop | Format-Table -AutoSize
} else {
    Write-Host "[OK] No Adobe Photoshop installation found on this host." -ForegroundColor Green
}

# 2. Confirm Adobe update services are present and running (needed to pull the fix)
$updateSvc = Get-Service -Name "AdobeUpdateService","AGSService" -ErrorAction SilentlyContinue |
             Select-Object Name, Status, StartType
$report.AdobeUpdateServices = $updateSvc
$updateSvc | Format-Table -AutoSize

# 3. Audit for .dcm files in user-writable locations created in the last 14 days (delivery vector)
$cutoff = (Get-Date).AddDays(-14)
$suspicious = Get-ChildItem "C:\Users\*\Downloads","C:\Users\*\AppData\Local\Temp" -Recurse -Filter *.dcm -ErrorAction SilentlyContinue |
              Where-Object { $_.LastWriteTime -gt $cutoff } |
              Select-Object FullName, LastWriteTime, Length
$report.RecentDcmFiles = $suspicious

if ($suspicious) {
    Write-Host "[REVIEW] Recent .dcm files found in user-writable paths — triage against known-good medical imaging workflows:" -ForegroundColor Yellow
    $suspicious | Format-Table -AutoSize
} else {
    Write-Host "[OK] No recent .dcm files in user-writable locations." -ForegroundColor Green
}

$report | ConvertTo-Json -Depth 4

Remediation

1. Patch immediately via Adobe Creative Cloud. Apply the latest Adobe Photoshop update referenced by Adobe's security bulletin corresponding to CVE-2026-75862 / ZDI-26-679. Force a Creative Cloud update sync across your fleet via your RMM or software deployment tooling — do not rely on users self-updating. Validate build numbers post-deployment against the fixed version listed in Adobe's advisory.
2. Verify the ZDI advisory for technical tracking and disclosure timeline: http://www.zerodayinitiative.com/advisories/ZDI-26-679/
3. Restrict the attack surface while patching rolls out:
   • Communicate to creative/marketing/healthcare-adjacent staff: do not open .dcm (DICOM) files from external or unexpected sources until the update is confirmed installed.
   • Where DICOM handling is not a business requirement, consider removing or blocking the .dcm file association to Photoshop via Group Policy / Intune file association policies.
   • Ensure email gateways and secure web gateways flag or sandbox .dcm attachments — a format that almost never legitimately transits email outside clinical environments.
4. Enforce least privilege and application control. Since exploitation runs as the current user, standard-user (non-admin) enforcement, Attack Surface Reduction rules, and application allowlisting (WDAC/AppLocker) meaningfully constrain post-exploitation capability even before the patch lands.
5. Monitor CISA KEV. The vulnerability is not in the Known Exploited Vulnerabilities catalog at disclosure time; add KEV monitoring for CVE-2026-75862 so any escalation to confirmed exploitation triggers an emergency-patch SLA in your environment.
6. Hunt retroactively. Run the KQL hunts above across at least 30 days of telemetry. If Photoshop has spawned a script interpreter or LOLBin on any endpoint, treat the host as potentially compromised and escalate to IR.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub