Creative Cloud Desktop CVE-2026-104349

Exploitation requires: (1) local access to a system running Adobe Creative Cloud Desktop at or below version 6.10.0.252.41; (2) a low-privileged authenticated user context (PR:L); and (3) user interaction - the victim must open a malicious file, which causes the application to load an attacker-controlled component from an uncontrolled search path element (CWE-427). Limiting factors that reduce realistic risk: the attack is local only (AV:L, not remotely reachable over a network), it depends on successful social engineering to make the victim open the malicious file, and resulting code runs only in the current user's context (S:U), not with elevated/SYSTEM privileges. The specific file type and the exact search path directory are not described in the available sources.

This is a moderate-priority local code-execution flaw (CVWE-427, Uncontrolled Search Path Element) in Adobe Creative Cloud Desktop, rated CVSS 7.3. The vendor-supplied vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H tells a consistent story: it is NOT a remote network vulnerability - the attack vector is local (AV:L), it requires a low-privileged authenticated user (PR:L), and critically it requires user interaction (UI:R), namely that a victim open a malicious file. The high C/I/A impacts reflect full code execution, but only in the context of the current user, not SYSTEM (S:U, no scope change). The vuln.today decision label is 'this_week', indicating it warrants prompt but not emergency attention. There is no CISA KEV listing and no EPSS score in the provided data, and no POC/exploit reference is supplied, so exploitation status is 'no public exploit identified at time of analysis'. The combination of local vector plus required user interaction materially lowers real-world risk versus the raw 7.3: this is a user-assisted local RCE useful in targeted social-engineering or post-access scenarios rather than mass exploitation. No conflicting signals are present; the main gap is the absence of EPSS and KEV data, which prevents a quantitative exploitation-probability estimate.

An attacker crafts a malicious file (or a malicious library placed in a directory searched before the trusted path) and uses social engineering to get a Creative Cloud Desktop user to open it on their machine. When opened, Creative Cloud Desktop loads the attacker-controlled component from the uncontrolled search path, executing arbitrary code with the victim's privileges. No public exploit code is identified in the provided data, and the local vector plus required user interaction limit this to targeted use.