CVE-2026-95635
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current use
CVSS
7.8
High
EPSS
0.2%
p12
KEV
—
Exploit Today
4
0-100
Published: Oct 13, 2026 · Last modified: Oct 14, 2026 · CWE-415
Not enough EPSS history yet.
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1105997.1 HIG—
——0L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply a crafted Annex-B elementary stream lacking a parseable SPS to lsmash_read_file() or the boxdumper, remuxer, or muxer tools, causing use-after-free, heap corruption, and crashes.21hCVE-2026-94370—24.8%
——7A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul::String interface type, and that text is held in a std::string, the conversion to the internal string type copies the pointer without taking ownership of it. Two objects then release the same memory, producing a double free, an invalid free, or a use-after-free.22hCVE-2026-978307.5 HIG58.4%
——18Double free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.18hCVE-2026-978127.0 HIG17.9%
——5Double free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.2dCVE-2026-978117.8 HIG13.5%
——4Double free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.2dCVE-2026-977728.8 HIG53.5%
——16Double free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.18h