Creative Cloud Desktop contains an uncontrolled search path element that allows an attacker to execute arbitrary code in the context of the user who opens a malicious file. The flaw stems from insecure handling of system paths, enabling a low‑privileged attacker to inject or replace executable files that the application may load. Successful exploitation results in full code‑execution compromise of the victim’s account and can be used to subsequently run malicious payloads or establish persistence.

Adobe Creative Cloud Desktop Application is affected. No specific versions are listed in the advisory, so all deployed releases may be vulnerable until an updated build is released.

The CVSS base score of 7.3 indicates a high severity impact. The EPSS score is not available, and the vulnerability is not yet listed in CISA’s KEV catalog, suggesting limited public exploitation to date. The only prerequisite for exploitation is user interaction – a victim must open a maliciously crafted file, after which the attacker can execute arbitrary code with the privileges of that user. Attackers who can influence a victim’s file list have a realistic opportunity to leverage this flaw.