CVE-2026-95636: Adobe Photoshop DCM Integer Overflow (ZDI-26-778) — Detection and Remediation Guide

The Zero Day Initiative has published ZDI-26-778, disclosing an integer overflow vulnerability in Adobe Photoshop's handling of DCM (DICOM) pixel data that allows remote attackers to execute arbitrary code on affected installations. Tracked as CVE-2026-95636 and rated CVSS 7.8 (High), the flaw requires user interaction — the target must open a malicious file or visit a malicious page — but that is a low bar. Malicious document delivery remains the single most reliable initial-access vector we see in IR engagements, and creative professionals routinely exchange large image assets from external sources.

If your environment includes design teams, marketing departments, print shops, medical imaging workflows, or any user base running Photoshop, this is a patch-now item. This post breaks down the vulnerability, how exploitation would present on the endpoint, and the detection and remediation controls you should deploy today.

At a Glance

Technical Analysis

The Vulnerability

The flaw resides in Photoshop's parsing of DCM files — the Digital Imaging and Communications in Medicine (DICOM) format. DICOM is the standard for medical imaging, but Photoshop has supported DICOM import for years (used in scientific, medical, and technical illustration workflows), which means the parser is reachable by any Photoshop installation, not just healthcare ones.

Per the ZDI advisory, the vulnerability is an integer overflow during parsing of pixel data within a crafted DCM file. The classic pattern here — and the one ZDI describes — works as follows:

1. The parser reads pixel data dimensions or length fields from the attacker-controlled DCM file.
2. An arithmetic operation on those values overflows, producing a smaller-than-expected allocation (or a wrapped size calculation).
3. The parser then copies pixel data into the undersized buffer, resulting in a heap-based out-of-bounds write.
4. A carefully crafted heap layout lets the attacker overwrite adjacent structures and hijack execution flow, achieving code execution in the context of the current user.

This is CWE-190 (Integer Overflow or Wraparound) leading to memory corruption — the same bug class that has driven decades of document-parser exploitation, and a class Adobe has patched repeatedly across its product line.

Exploitation Delivery Chain

From a defender's perspective, the realistic attack chain looks like this:

• Delivery: A malicious .dcm file arrives via phishing email attachment, a download from a compromised or attacker-controlled site, a shared asset library, or a cloud storage link. DICOM's association with medical imaging makes it a plausible lure for healthcare-adjacent targets, but any Photoshop user is a victim candidate.
• Trigger: The user opens the file directly in Photoshop, or Photoshop's parser is invoked via a malicious page/preview handler.
• Execution: Photoshop's process is corrupted during parse; attacker code executes as the user. Typical follow-on behavior is Photoshop spawning a child process (script interpreter, rundll32, a dropped payload) or writing a second-stage executable to a user-writable location (%TEMP%, %APPDATA%, Downloads).
• Impact: Because execution runs with the victim's privileges, anything that user can do, the attacker can do — read files, access mapped shares, establish persistence, and pivot.

Exploitation Status

At the time of writing, the advisory is a coordinated disclosure via ZDI with a CVSS 7.8 rating. There is no public confirmation of in-the-wild exploitation in the disclosure summary, and the CVE has not yet been listed in CISA's Known Exploited Vulnerabilities catalog. Treat that as breathing room, not comfort: file-parser bugs in ubiquitous desktop applications are prime candidates for exploit-kit and phishing-campaign weaponization once technical details circulate. The window between disclosure and opportunistic exploitation for this bug class is historically measured in weeks, not quarters.

Detection & Response

Since exploitation is a memory-corruption event inside Photoshop.exe, you will rarely catch the overflow itself with signature tooling. The high-fidelity detection opportunities are post-exploitation behaviors: Photoshop spawning child processes, writing executables, or making unexpected network connections, plus the delivery artifact (.dcm files arriving via email or browser download channels).

Sigma Rules

---
title: Adobe Photoshop Spawned Suspicious Child Process
id: 3b7c2a91-8f4e-4d1a-bc25-9e6a5f0d12c8
status: experimental
description: Detects Photoshop.exe spawning script interpreters, LOLBins, or shell processes, consistent with post-exploitation behavior following file-parser exploitation such as CVE-2026-95636 (ZDI-26-778 DCM integer overflow).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-778/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Photoshop.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Photoshop plugins or scripts invoking system tools (rare; investigate rather than whitelist broadly)
level: high
---
title: Adobe Photoshop Process Writing Executable to User-Writable Directory
id: 8d4e1f63-2a9b-4c77-ae51-6f3b8d0c94e7
status: experimental
description: Detects Photoshop.exe creating executable or script files in user-writable locations, indicative of second-stage payload dropping after successful exploitation of a document parser vulnerability such as CVE-2026-95636.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-778/
  - https://attack.mitre.org/techniques/T1204.002/
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith: '\Photoshop.exe'
  selection_target_dir:
    TargetFilename|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
  selection_target_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
      - '.bat'
      - '.cmd'
      - '.ps1'
      - '.js'
      - '.vbs'
  condition: selection_source and selection_target_dir and selection_target_ext
falsepositives:
  - Photoshop installer/updater activity (filter on signed Adobe updater paths and known version-update windows)
level: high
---
title: DICOM File Arrival via Browser or Email Client Download
id: 5a9f3d27-7c1e-4b48-9d62-4e8c2a1f06b3
status: experimental
description: Detects .dcm (DICOM) files being written by browsers or email clients, a delivery artifact consistent with malicious DCM distribution for CVE-2026-95636. Tune to your environment - medical imaging organizations will need scoping.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-778/
  - https://attack.mitre.org/techniques/T1566.001/
author: Security Arsenal
date: 2026/01/20
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1566.002
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.dcm'
      - '.dicom'
  selection_source:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
  condition: selection_ext and selection_source
falsepositives:
  - Healthcare and medical research workflows with legitimate DICOM exchange - scope by user department or exclude known PACS/imaging stations
level: medium

KQL — Microsoft Sentinel / Defender

The following hunt looks across a 14-day window for the two highest-fidelity signals: Photoshop spawning shell/scripting children, and .dcm files delivered through browsers or Outlook followed by Photoshop activity on the same device.

// Hunt 1: Photoshop spawning suspicious child processes (post-exploitation behavior)
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","wmic.exe","certutil.exe","bitsadmin.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "Photoshop.exe"
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt 2: DCM file delivered via browser/Outlook, then opened by Photoshop within 1 hour
let DcmDelivery = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".dcm" or FileName endswith ".dicom"
| where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","OUTLOOK.EXE","thunderbird.exe")
| project DeliveryTime=TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName;
DcmDelivery
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "Photoshop.exe"
    | project PhotoshopLaunch=TimeGenerated, DeviceName, PhotoshopCmd=ProcessCommandLine, AccountName
) on DeviceName
| where PhotoshopLaunch between (DeliveryTime .. DeliveryTime + 1h)
| project DeliveryTime, DeviceName, AccountName, FileName, FolderPath, PhotoshopLaunch, PhotoshopCmd
| sort by DeliveryTime desc;

Velociraptor VQL

For endpoint triage on a host where a user reports opening a suspicious imaging file, this artifact enumerates Photoshop child processes and recently written executables in user-writable paths — the two artifacts a successful exploit leaves behind.

-- CVE-2026-95636 triage: Photoshop child processes and dropped executables
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)Photoshop\.exe$'
   OR CommandLine =~ '(?i)Photoshop'

-- Follow-up scope: executables recently created in user-writable dirs
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.exe',
                 'C:/Users/*/AppData/Local/Temp/*.dll',
                 'C:/Users/*/Downloads/*.exe',
                 'C:/Users/*/AppData/Roaming/*.exe'])
WHERE Mtime > (now() - 86400 * 7)
ORDER BY Mtime DESC

Run the pslist() portion first to confirm whether Photoshop is (or was) running with unexpected children, then pivot into the glob results to identify candidate second-stage payloads for hash reputation and sandbox detonation.

Remediation

1. Patch Adobe Photoshop Immediately

Apply the Adobe security update that resolves CVE-2026-95636 via the Creative Cloud desktop application or your enterprise deployment channel (Admin Console package, RMM, or Intune/SCCM for managed fleets). Verify the update against Adobe's security bulletin referenced from the ZDI advisory:

• ZDI advisory: http://www.zerodayinitiative.com/advisories/ZDI-26-778/
• Adobe security bulletins portal: https://helpx.adobe.com/security/security-bulletin.html

Do not assume auto-update is enabled — in our assessments, Creative Cloud auto-update is disabled in a large share of enterprise deployments because of change-control concerns. Inventory first, patch second, verify third.

2. Inventory and Verification Script

Use this PowerShell script to enumerate installed Photoshop versions across your fleet and flag hosts that need attention. Run it via your RMM, Intune proactive remediations, or a GPO startup script, and collect output centrally.

# CVE-2026-95636 - Photoshop version inventory and exposure check
$results = @()

# Check both 64-bit registry hives for Adobe Photoshop installs
$uninstallPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$psInstalls = Get-ItemProperty -Path $uninstallPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Adobe Photoshop' } |
    Select-Object DisplayName, DisplayVersion, InstallDate

# Confirm the binary on disk and pull its file version
$psExe = Get-ChildItem -Path "${env:ProgramFiles}\Adobe" -Recurse -Filter 'Photoshop.exe' -ErrorAction SilentlyContinue |
    Select-Object -First 1

$fileVersion = if ($psExe) { (Get-Item $psExe.FullName).VersionInfo.FileVersion } else { 'NotFound' }

# Check whether DCM file association is registered (attack surface indicator)
$dcmAssoc = (cmd /c "assoc .dcm" 2>$null)

$results += [PSCustomObject]@{
    Hostname         = $env:COMPUTERNAME
    PhotoshopProduct = ($psInstalls.DisplayName -join '; ')
    RegistryVersion  = ($psInstalls.DisplayVersion -join '; ')
    BinaryVersion    = $fileVersion
    DcmAssociation   = if ($dcmAssoc) { $dcmAssoc } else { 'None' }
    CheckTime        = (Get-Date -Format 'o')
    Action           = 'Verify version against Adobe APSB bulletin for CVE-2026-95636; update via Creative Cloud if outdated'
}

$results | Format-List
# For fleet collection, pipe to CSV on a central share:
# $results | Export-Csv -Path "\\your-share\patch-audit\$env:COMPUTERNAME-pshop-audit.csv" -NoTypeInformation

Compare the reported BinaryVersion/RegistryVersion against the fixed version listed in Adobe's security bulletin. Any host below the fixed build is exposed.

3. Reduce Attack Surface Until Patch Is Verified

If patching will take days due to change control, deploy compensating controls:

• Block DCM at the email gateway. Add .dcm and .dicom to your attachment filtering policy unless you have a documented medical-imaging business need. This kills the highest-probability delivery vector without touching endpoints.
• Strip DCM file association. On non-healthcare endpoints, remove the .dcm association to Photoshop so double-clicking a delivered file does not invoke the vulnerable parser: cmd /c "assoc .dcm=" — pair this with user communication.
• Exploit protection. Ensure Microsoft Defender Exploit Guard / Attack Surface Reduction rules are enabled, particularly "Block Office applications from creating child processes"-style equivalents and arbitrary-code-guard policies for Adobe apps where supported. Consider adding Photoshop.exe to a custom ASR child-process block rule; Photoshop almost never legitimately spawns child processes.
• Application sandboxing. Where available, open untrusted image files in a sandbox or VM (or a dedicated analysis workstation) before allowing them into production creative workstations.

4. User Awareness — Targeted, Not Generic

Send a short, specific advisory to Photoshop-licensed users: do not open DICOM/DCM files or image assets from untrusted external sources until the update is confirmed. Generic "don't open attachments" messaging gets ignored; a note that names their tool and the file type lands.

5. Hunt Retroactively

Run the KQL hunts above across at least the last 30 days. If you find Photoshop spawning shells or script interpreters, treat it as a potential incident: isolate the host, capture memory if feasible, collect the DCM source artifact, and review the user's mail and download history for the delivery vector.

The Bigger Lesson

Integer overflows in media parsers are not glamorous, but they are the workhorse of targeted intrusion. Creative and design workstations are high-value, low-hardening targets in most enterprises — they hold brand assets, credentials to marketing platforms, and often sit outside the strictest EDR policies because of perceived "performance impact." CVE-2026-95636 is a good forcing function to fix that: get Photoshop under your standard patch SLA, your standard ASR policy, and your standard child-process monitoring. The next advisory of this class is already in a researcher's queue.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub