CVE-2016-0951

published 2016-02-10

CVE-2016-0951: Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of…

Priority P2 63 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0952 and CVE-2016-0953.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
adobe	bridge_cc	<= 6.1	—
adobe	photoshop_cc	<= 16.1.1	—

Detection & IOCs extracted from sources · hover to see the quote

url http://protekresearchlab.com/exploits/COSIG-2016-08-1.png↗

url http://protekresearchlab.com/exploits/COSIG-2016-08-2.png↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39429.zip↗

• → Trigger is a malformed PNG file with an invalid uint32 Length field, causing heap memory corruption — inspect PNG chunk length fields for anomalous/oversized uint32 values in files opened by Photoshop or Bridge CC. ↗
• → Exploitation requires user interaction: the target must open a malicious .png file. Alert on PNG files opened by Adobe Photoshop CC (≤16.1.1) or Bridge CC (≤6.1.1) processes, especially files sourced from untrusted/remote locations. ↗
• → Both PoC PNG files must reside in the same folder for exploitation via Bridge CC — monitor for multiple suspicious PNG files dropped together into the same directory. ↗
• → Vulnerable file type is .png — monitor for heap corruption or abnormal memory access originating from PNG parsing code paths within Photoshop CC and Bridge CC processes on Windows. ↗

• · Vulnerability affects Windows platform only per the advisory scope. ↗
• · Affected versions are Bridge CC 6.1.1 and earlier, and Photoshop CC 16.1.1 (2015.1.1) and earlier; patched by Adobe in APSB16-03 released 2016-02-09. ↗
• · This CVE is one of three distinct memory corruption vulnerabilities (CVE-2016-0951, CVE-2016-0952, CVE-2016-0953) addressed in the same patch — ensure all three are tracked separately. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119