CVE-2026-48388

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://cwe.mitre.org/data/definitions/427.html	Technical Description
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360

Configurations

Configuration 1 (hide)

cpe:2.3:a:adobe:photoshop_installer:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-28 18:17

Updated : 2026-08-26 17:17

NVD link : CVE-2026-48388

Mitre link : CVE-2026-48388

CVE.ORG link : CVE-2026-48388

JSON object : View

Products Affected

adobe

photoshop_installer

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-48388", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48388", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-28T19:35:03.999809Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "Adobe Photoshop Installer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "N/A"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-28T18:17:20.887", "references": [{"url": "https://cwe.mitre.org/data/definitions/427.html", "tags": ["Technical Description"], "source": "psirt@adobe.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed."}], "lastModified": "2026-08-26T17:17:02.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:photoshop_installer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B949875F-9F64-4B27-AB66-008E3C00A218"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}