CVE-2026-48388

HIGH 8.6 ALL-YEARS

Published 2026-07-28 · Last modified 2026-08-26 · adobe · NVD: Modified

Adobe Photoshop Installer was affected by an Uncontrolled Search Path Element vulnerability that could have resulted in arbitrary code execution in the context of the current user. An attacker could have exploited this vulnerability by placing a malicious library in a directory searched by the installer. Exploitation of this issue required user interaction in that a victim must have been running the installer. Scope is changed.

ELEVATED IMPACT

Severe if exploited (CVSS 8.6), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 23rd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

8.6CVSS 3.1 · HIGH · CNA

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

⚠Access: Requires local access to the host
✓Privileges: No account or privileges required
⚠User interaction: A user must take an action (click / open a file)
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Adobe

Products Adobe Photoshop Installer Photoshop Installer

Weakness (CWE)

CWE-427: : Uncontrolled Search Path Element

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References and research data (JSON)

Known Affected Software Configurations

Vendor	Product	Version range
Adobe	Photoshop Installer	*

All CVSS metrics

HIGH 8.6 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
HIGH 8.6 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49932 ADVISORYEUVD · EUVD-2026-49932

Technical & other

https://cwe.mitre.org/data/definitions/427.html Technical DescriptionCVE record · adobe · Updated 2026-07-28T17:46:26.236Z
NVD · CVE-2026-48388 · Updated 2026-10-23T23:10:00.157
https://www.talosintelligence.com/vulnerability_reports/TALOS-2026-2360CVE record · CVE · Updated 2026-08-26T16:28:35.442Z
NVD · CVE-2026-48388 · Updated 2026-10-23T23:10:00.157

Sources: NVD · CVE.org · All sources and attribution · EPSS