Uncontrolled Search Path Vulnerability in Adobe Photoshop Installer

Executive Summary

CVE-2026-34632 is an Uncontrolled Search Path Element vulnerability affecting the Adobe Photoshop Installer. This means the installer uses a search path to locate critical resources, but that path can be manipulated by a low-privileged local attacker. By altering the search path, the attacker can cause the installer to load and execute unauthorized code in the context of the current user. Exploitation requires that a user is running the installer and involves manipulating directories or environment variables that the installer trusts to find its resources.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the Adobe Photoshop Installer or related processes are using uncontrolled or writable directories in their search paths for critical resources such as DLLs or executables.

On Windows systems, you can check the search path environment variables and the directories from which the installer loads resources. Look for suspicious directories like writable folders, network shares (SMB, WebDAV), or the current working directory being included in the search path.

Suggested commands include:

• Using PowerShell to check the PATH environment variable: `echo $Env:PATH`
• Listing loaded DLLs for the installer process to see if any are loaded from unexpected locations (using tools like Process Explorer or `Get-Process` in PowerShell).
• Checking directory permissions on folders included in the search path to identify writable or untrusted directories.

On Unix-like systems, check for empty elements in the PATH variable or the presence of '.' (current directory) in the PATH by running: `echo $PATH` and inspecting for unsafe entries.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution with the privileges of the current user running the Adobe Photoshop Installer. An attacker with low privileges on the local system could exploit this by manipulating the search path, potentially causing unauthorized code to run. This can compromise the confidentiality, integrity, and availability of the affected system, allowing the attacker to execute malicious actions such as installing malware, stealing data, or disrupting system operations.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-34632 allows unauthorized code execution through manipulation of search paths in the Adobe Photoshop Installer. This can lead to unauthorized access, modification, or disruption of data and system resources.

Such unauthorized code execution and potential data compromise can negatively impact compliance with standards and regulations like GDPR and HIPAA, which require protection of data confidentiality, integrity, and availability.

Exploitation of this vulnerability could result in breaches of sensitive personal or health information, thereby violating regulatory requirements for data protection and potentially leading to legal and financial consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include controlling and sanitizing the search paths used by the Adobe Photoshop Installer to prevent loading resources from untrusted or writable directories.

• Ensure that the installer uses fully qualified paths when loading executables or DLLs, avoiding reliance on relative or environment-dependent search paths.
• Remove or restrict environment variables such as PATH and LD_LIBRARY_PATH before running the installer to exclude unsafe directories.
• Avoid including writable or network share directories in the search path.
• Use tools or configurations to hard-code search paths to known safe directories.
• Educate users to avoid running the installer from untrusted locations or directories that may be writable by low-privileged users.

Useful 0 Not Useful 0