CVE-2026-48388
Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Search Path Element in Adobe Photoshop Installer

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Adobe Systems Incorporated

Description
Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-48388
EUVD
EUVD-2026-49932

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adobe photoshop_installer *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Uncontrolled Search Path Element issue in Adobe Photoshop Installer. It allows arbitrary code execution by placing a malicious library in a directory searched by the installer. Exploitation requires user interaction as the victim must run the installer.

Detection Guidance

To detect this vulnerability, check for directories in the search path of Adobe Photoshop Installer that are writable or controlled by unauthorized users. On Windows, inspect the PATH environment variable and current working directory for suspicious libraries. Use commands like 'echo %PATH%' or 'where photoshop_installer.exe' to review search paths.

Impact Analysis

An attacker could execute malicious code on your system with the same privileges as the current user. This could lead to data theft, system compromise, or further attacks. Since exploitation requires running the installer, users should avoid downloading or running untrusted software.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data confidentiality and integrity requirements in GDPR and HIPAA. Exploitation may result in unauthorized access to personal or health data, triggering compliance breaches under these regulations.

Mitigation Strategies

Immediately update Adobe Photoshop Installer to the latest version. Avoid running the installer from untrusted directories. Restrict write permissions on directories in the search path. Use fully qualified paths when invoking the installer and sanitize environment variables like PATH before execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48388. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart