CVE-2026-34632

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/427.html	Technical Description
https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2274	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:photoshop_installer:2.11.0.30:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) El Instalador de Adobe Photoshop se vio afectado por una vulnerabilidad de elemento de ruta de búsqueda no controlada que podría haber resultado en la ejecución de código arbitrario en el contexto del usuario actual. Un atacante local con pocos privilegios podría haber explotado esta vulnerabilidad manipulando la ruta de búsqueda utilizada por la aplicación para localizar recursos críticos, lo que podría causar la ejecución de código no autorizada. La explotación de este problema requería interacción del usuario, ya que un usuario tenía que estar ejecutando el instalador.

Information

Published : 2026-04-15 19:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-34632

Mitre link : CVE-2026-34632

CVE.ORG link : CVE-2026-34632

JSON object : View

Products Affected

adobe

photoshop_installer

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-34632", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34632", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-15T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Photoshop Installer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "N/A"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-15T19:16:36.223", "references": [{"url": "https://cwe.mitre.org/data/definitions/427.html", "tags": ["Technical Description"], "source": "psirt@adobe.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2274", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed."}, {"lang": "es", "value": "El Instalador de Adobe Photoshop se vio afectado por una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada que podr\u00eda haber resultado en la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. Un atacante local con pocos privilegios podr\u00eda haber explotado esta vulnerabilidad manipulando la ruta de b\u00fasqueda utilizada por la aplicaci\u00f3n para localizar recursos cr\u00edticos, lo que podr\u00eda causar la ejecuci\u00f3n de c\u00f3digo no autorizada. La explotaci\u00f3n de este problema requer\u00eda interacci\u00f3n del usuario, ya que un usuario ten\u00eda que estar ejecutando el instalador."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:photoshop_installer:2.11.0.30:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2462C587-B3A4-4301-91AF-A2E5E32A41C4"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}