Adobe Photoshop Installer
Monthly
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Uncontrolled search path vulnerability in Adobe Photoshop Installer allows a low-privileged local attacker to execute arbitrary code in the context of the current user. Exploitation requires the user to run the installer from a location where the attacker has planted malicious dependencies. No active exploitation or public exploit code has been identified, and the EPSS chance of exploitation is extremely low (0.01%).
We need to produce a JSON object with multiple fields. Let's analyze the input. CVE ID: CVE-2026-48388 Description: Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed. CVSS Score: 8.6 CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-427 Multi-source: Reported by Adobe. CPE: cpe:2.3:a:adobe:adobe_photoshop_installer:*:*:*:*:*:*:*:* (all versions?). Tags: Adobe, RCE, Adobe Photoshop Installer. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. ENISA EUVD ID. Affected versions from EUVD: ["Adobe Photoshop Installer 0 ≤N/A"] - weird, maybe that's not precise. References: cveorg link (None?) and euvd advisory NVD link. Now, we must fill out all fields. No arrays, no nested JSON, plain text strings. product_name: 1-3 words ONLY. Affected product is "Adobe Photoshop Installer". So "Adobe Photoshop Installer". That's 3 words. Could also be just "Photoshop Installer" but better to include "Adobe". I'll output "Adobe Photoshop Installer". summary: 2-3 sentence plain-language synthesis. Not copying description. Should start with specific impact and product, e.g., "Arbitrary code execution in Adobe Photoshop Installer allows..." but careful: it's the installer, not Photoshop itself. The vulnerability is uncontrolled search path element (DLL hijacking). The attacker places a malicious library in a directory searched by the installer, and when the victim runs the installer, arbitrary code executes in the current user context. User interaction required. Use all data: SSVC says not exploited (none), not automatable, total impact. EPSS? None provided. KEV? Not mentioned.
Uncontrolled search path vulnerability in Adobe Photoshop Installer allows a low-privileged local attacker to execute arbitrary code in the context of the current user. Exploitation requires the user to run the installer from a location where the attacker has planted malicious dependencies. No active exploitation or public exploit code has been identified, and the EPSS chance of exploitation is extremely low (0.01%).