cbcvebase.
CVE-2016-0953
published 2016-02-10

CVE-2016-0953: Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of…

PriorityP263critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
20.55%
97.2th percentile
Adobe Photoshop CC 2014 before 15.2.4, Photoshop CC 2015 before 16.1.2, and Bridge CC before 6.2 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-0951 and CVE-2016-0952.

Affected

2 ranges
VendorProductVersion rangeFixed in
adobebridge_cc<= 6.1—
adobephotoshop_cc<= 16.1.1—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://protekresearchlab.com/exploits/COSIG-2016-10.iff↗
urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39431.zip↗
filenameCOSIG-2016-10.iff↗
  • →Trigger is a malformed IFF file opened by the user — hunt for suspicious .iff file opens in Photoshop CC or Bridge CC processes ↗
  • →Exploitation requires user interaction (opening a malicious file); monitor email/web delivery of .iff attachments targeting Windows hosts running Photoshop CC ≤16.1.1 or Bridge CC ≤6.1.1 ↗
  • →Arbitrary code executes under the context of the Photoshop CC or Bridge CC application process — monitor for unexpected child processes spawned by Photoshop.exe or Bridge.exe ↗
  • ·Vulnerability affects Windows platform only per the advisory ↗
  • ·Affected versions: Bridge CC 6.1.1 and earlier; Photoshop CC 16.1.1 (2015.1.1) and earlier — patched in APSB16-03 (2016-02-09) ↗
  • ·CVE-2016-0953 is one of three distinct memory-corruption vulnerabilities in the same advisory (APSB16-03), alongside CVE-2016-0951 and CVE-2016-0952 ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.