CVE-2026-48388 – Adobe Photoshop Installer
“Even a trusted installer can become an attack vector when it searches the wrong place.”
This patch addresses CVE-2026-48388, an Uncontrolled Search Path Element vulnerability (CWE-427) affecting the Adobe Photoshop Installer. The CVSS score is 8.6, which is High severity. No verified real-world exploitation has been reported.
The vulnerability could allow an attacker to achieve arbitrary code execution in the context of the current user by placing a malicious library in a directory searched by the installer. Exploitation requires user interaction, as the victim must run the affected installer. While the vulnerability is not identified as Remote Code Execution (RCE), it has Elevation of Privilege (EoP) characteristics because it enables unauthorized code execution within the user’s security context. Adobe has addressed the issue by correcting the installer behavior to prevent loading malicious libraries from uncontrolled search paths.
Key Details
- Affected Product
- Adobe Photoshop Installer
- Attack Vector
- Local
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-427