CVE-2026-48388

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/427.html	Technical Description
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:photoshop_installer:-:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Adobe Photoshop Installer se vio afectado por una vulnerabilidad de elemento de ruta de búsqueda no controlada que podría haber resultado en ejecución de código arbitrario en el contexto del usuario actual. Un atacante podría haber explotado esta vulnerabilidad al colocar una biblioteca maliciosa en un directorio buscado por el instalador. La explotación de este problema requería interacción del usuario en que una víctima debía haber estado ejecutando el instalador. El alcance ha cambiado.

Information

Published : 2026-07-28 18:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-48388

Mitre link : CVE-2026-48388

CVE.ORG link : CVE-2026-48388

JSON object : View

Products Affected

adobe

photoshop_installer

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-48388", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48388", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T19:35:03.999809Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Photoshop Installer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "N/A"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-28T18:17:20.887", "references": [{"url": "https://cwe.mitre.org/data/definitions/427.html", "tags": ["Technical Description"], "source": "psirt@adobe.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed."}, {"lang": "es", "value": "Adobe Photoshop Installer se vio afectado por una vulnerabilidad de elemento de ruta de b\u00fasqueda no controlada que podr\u00eda haber resultado en ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. Un atacante podr\u00eda haber explotado esta vulnerabilidad al colocar una biblioteca maliciosa en un directorio buscado por el instalador. La explotaci\u00f3n de este problema requer\u00eda interacci\u00f3n del usuario en que una v\u00edctima deb\u00eda haber estado ejecutando el instalador. El alcance ha cambiado."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:photoshop_installer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B949875F-9F64-4B27-AB66-008E3C00A218"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}