EUVD-2026-49932
GHSA-732p-c5p6-vp34
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local write access to a searched directory
-
DeliveryPlant malicious library alongside installer
-
ExploitVictim runs Photoshop installer
-
ExecutionInstaller loads attacker library
-
ImpactArbitrary code executes as current user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation requires: (1) local file-write access to a directory that is on the installer's library search path (the attacker must pre-position a malicious library on the target system), and (2) user interaction - the victim must actively launch the Adobe Photoshop Installer, at which point the planted library is loaded. These are the concrete limiting factors: it is not remotely exploitable (AV:L), it is not automatable (SSVC Automatable: no), and it depends on the specific installer's search order and a directory the attacker can write to. Resulting code execution is in the context of the current user, not necessarily elevated. |
| Impact | This is a classic uncontrolled search path element (CWE-427, library/DLL hijacking) flaw in the Adobe Photoshop Installer, and the signals converge on a genuinely low real-world priority despite the 8.6 'High' CVSS. The CVSS vector is AV:L (local - the attacker must place a malicious library on the local filesystem in a directory the installer searches) with UI:R (a victim must actively run the installer), which are strong limiting factors. All threat-activity signals point the same direction: EPSS is 0.17% (7th percentile), there is no CISA KEV listing, no public exploit code identified, and CISA's SSVC scores Exploitation: none and Automatable: no. The one aggravating signal is SSVC Technical Impact: total, consistent with the C:H/I:H/A:H arbitrary code execution outcome. The signals are internally consistent (not conflicting): high technical impact but low/no exploitation likelihood and non-automatable, because it requires local file placement plus a user running an installer. Note one description/vector tension worth verifying: the vector claims S:C (scope changed) while the description says code executes 'in the context of the current user,' which suggests no privilege boundary is actually crossed - this inflates the base score. Bottom line: real technical impact but low realistic risk (targeted, local, user-interaction-gated), not a drop-everything patch. |
| Exploit ScenarioDerived | An attacker who can write to a directory the installer searches (e.g., the Downloads or Desktop folder where the installer typically resides, or a per-user writable path on the search order) plants a malicious library. When the victim launches the Photoshop installer, the installer loads the attacker's library instead of the legitimate one, executing arbitrary code in the current user's context. No public exploit code or active exploitation has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Arbitrary code execution is possible in the Adobe Photoshop Installer through an uncontrolled search path element (CWE-427), where a malicious library planted in a directory the installer searches is loaded when the installer runs. Exploitation is local and requires user interaction - an attacker must first place a malicious library on the target system and then convince a victim to launch the installer, after which code runs in the context of that user rather than with elevated privileges. Public exploitation signals are weak: there is no confirmed active exploitation (not in CISA KEV), no public exploit identified at time of analysis, and EPSS is only 0.17% (7th percentile), although the CVSS base score of 8.6 and a 'total' technical impact rating keep it relevant for hardening. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) indicates a local, unauthenticated attack path that nonetheless depends on user initiation and a writable directory within the installer's search path.
RemediationAI
No vendor-released patch version is identified for this CVE in the available data - the CPE is an unconstrained wildcard and no fix version is enumerated - so confirm with Adobe's advisory and the Talos report (https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360) whether a corrected installer build has shipped before assuming any release is safe. Until a fixed installer is confirmed, apply compensating controls that target the two preconditions: deny local users write access to the installer's own directory and any directory on its library search path (for example, tighten NTFS ACLs on the installer location and on world-writable temp and staging folders), which reduces the hijack surface but requires enforcing consistent permissions across endpoints. Obtain and run installer packages from a trusted source with hash or signature verification, and stage them in a directory that is not writable by non-administrators, so a planted library cannot be co-located with the installer binary. For managed fleets, use application allowlisting and DLL-loading policies (such as blocking library loads from user-writable paths for the installer process) to prevent unsigned or unexpected libraries from being resolved; these measures carry operational overhead and can break legitimate side-by-side installs if not scoped narrowly. Because exploitation requires the victim to launch the installer, restricting who may execute the installer to privileged administrators further reduces exposure, at the cost of removing self-service installations. Note that EPSS is 0.17% (7th percentile), no public exploit has been identified, and CISA SSVC records exploitation as none, so these controls can be prioritized behind higher-risk findings.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-427 (Uncontrolled Search Path Element), the classic binary-planting / DLL-hijacking pattern in which an application loads a library by name without pinning an absolute, trusted path or validating the resolved location. When the Adobe Photoshop Installer resolves a library, the operating system's loader walks a defined search order that can include the current working directory, the executable's directory, and paths referenced by environment variables; any location on that chain that a low-privileged user can write to becomes a hijack point. The affected CPE (cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:*) uses a wildcard version, meaning no specific fixed release is enumerated in the CPE data, and ENISA's EUVD entry likewise lists the version range as N/A rather than bounding it. The supplied CVSS vector places the attack vector at Local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), and Adobe's scoring asserts a Scope change (S:C), while the independent assessment scores scope as Unchanged (S:U) because the resulting code runs at the same privilege level as the invoking user. The SSVC evaluation (Exploitation: none, Automatable: no, Technical Impact: total) reinforces that this flaw is not remotely reachable and cannot be triggered without the victim actively starting the installer.
Know when Adobe Photoshop Installer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local library planting (AV:L) plus victim-run installer (UI:R); code executes only as the current user with no privilege boundary crossed, so S:U rather than the vendor's S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.
Executive ViewAI
A high-severity flaw in the Adobe Photoshop Installer allows code to run on a workstation when a user launches the installer from or near a directory where an attacker has already planted a malicious library file. Because the attacker must first obtain a foothold to place that file and then persuade a user to run the installer, the practical risk is concentrated in endpoints where users routinely run installers from shared, downloaded, or user-writable locations. With no vendor fix available and no observed exploitation, leadership should treat this as a manageable but unpatched exposure requiring tightened software deployment and endpoint controls rather than emergency response.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict write access to installer directories and remove them from user-writable locations; require users to install Photoshop only via the managed Creative Cloud channel rather than standalone installer files; enforce application allowlisting and block execution of unsigned libraries; apply DLL search-order hardening where the installer supports it; operate users without local administrator rights; monitor endpoint telemetry for anomalous library loads tied to Adobe installer processes; and instruct users not to run installers from Downloads, temporary, or shared network folders.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB