Adobe Photoshop Installer contains an uncontrolled search path element flaw that allows an attacker to place a malicious library in a directory searched by the installer. If the installer loads that library, the code inside runs with the privileges of the user executing the installer, potentially compromising the entire system. The vulnerability is classified as CWE‑427 and carries a CVSS score of 8.6, indicating a high‑severity flaw. Because the installer must be run by a user and the flaw changes the permission scope, the impact reaches system resources.

The affected product is the Adobe Photoshop Installer. All versions that have not yet received a patch for this uncontrolled search path element are vulnerable. Users who download or run the installer are at risk. No specific version numbers are listed in the vendor’s disclosure.

The flaw requires user interaction and is therefore of the local attack vector type. Once the attacker places a malicious library in a location the installer searches, the installer will load it, executing arbitrary code under the current user’s context. The CVSS score of 8.6 signals high severity, but the EPSS score of less than 1% shows that known exploitation attempts are very rare. The vulnerability is not yet listed in CISA’s KEV catalog, meaning it has not been confirmed as actively exploited in the wild.