CVE-2025-21127: Adobe Photoshop RCE Vulnerability

CVE-2025-21127 Overview

CVE-2025-21127 is an Uncontrolled Search Path Element vulnerability affecting Adobe Photoshop Desktop versions 25.12, 26.1 and earlier. This vulnerability could allow an attacker to achieve arbitrary code execution by manipulating the search path environment variable to point to a malicious library. When the vulnerable application loads, it may inadvertently execute the attacker's malicious code instead of the legitimate library.

Critical Impact

Successful exploitation allows arbitrary code execution with the privileges of the user running Adobe Photoshop. An attacker could gain complete control over the affected system, potentially leading to data theft, malware installation, or lateral movement within an organization.

Affected Products

• Adobe Photoshop versions 25.12 and earlier
• Adobe Photoshop versions 26.1 and earlier
• Affected on both Microsoft Windows and Apple macOS platforms

Discovery Timeline

• 2025-01-14 - CVE-2025-21127 published to NVD
• 2025-02-11 - Last updated in NVD database

Technical Details for CVE-2025-21127

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element), a weakness that occurs when an application searches for critical resources such as libraries or executables in locations that could be under attacker control. In the case of Adobe Photoshop, the application follows a search path when loading dynamic libraries that can be manipulated by an attacker.

The vulnerability requires local access and user interaction, meaning a victim must run the vulnerable Photoshop application for the attack to succeed. However, once exploited, the consequences are severe as it grants the attacker the ability to execute arbitrary code with the same privileges as the running application.

Root Cause

The root cause stems from Adobe Photoshop's improper handling of the library search path. The application does not sufficiently validate or restrict the directories from which it loads dynamic-link libraries (DLLs) on Windows or dynamic libraries on macOS. This allows an attacker who can modify the search path environment variable or place a malicious library in a directory that appears earlier in the search order to hijack the library loading process.

Attack Vector

The attack vector is local, requiring the attacker to have the ability to either modify environment variables or place malicious files in specific directories on the target system. A typical attack scenario involves:

1. The attacker places a malicious DLL (Windows) or dylib (macOS) in a directory that the application searches before the legitimate library location
2. The attacker may also manipulate the PATH or other relevant environment variables to include a directory containing the malicious library
3. When the victim launches Adobe Photoshop, the application loads the malicious library instead of the legitimate one
4. The malicious code executes with the privileges of the user running Photoshop

This type of attack is often referred to as "DLL hijacking" on Windows or "dylib hijacking" on macOS. The vulnerability requires user interaction as the victim must launch the Photoshop application for the malicious code to execute.

Detection Methods for CVE-2025-21127

Indicators of Compromise

• Unexpected DLL or dylib files appearing in directories within the application's search path
• Modifications to environment variables such as PATH that add suspicious directories
• Unusual library loading behavior when Adobe Photoshop launches
• Presence of libraries with legitimate Adobe names in non-standard locations

Detection Strategies

• Monitor for DLL or dylib files being loaded from unexpected directories when Photoshop launches
• Implement application allowlisting to prevent unauthorized libraries from loading
• Use endpoint detection and response (EDR) solutions to identify suspicious library loading patterns
• Enable Windows Event Logging for process creation and module loading events

Monitoring Recommendations

• Configure SentinelOne to alert on library loading from non-standard directories
• Monitor for changes to the PATH environment variable, particularly additions of writable directories
• Track file creation events in directories commonly searched by applications
• Implement behavioral analysis to detect unusual process execution chains following Photoshop launch

How to Mitigate CVE-2025-21127

Immediate Actions Required

• Update Adobe Photoshop to the latest patched version immediately
• Review and validate the PATH environment variable on systems running Photoshop
• Audit directories in the library search path for unauthorized DLL or dylib files
• Restrict write permissions on directories that appear in the application search path

Patch Information

Adobe has released security updates to address this vulnerability as documented in Adobe Security Advisory APSB25-02. Organizations should update to the latest version of Adobe Photoshop as soon as possible. The update addresses the uncontrolled search path element issue by implementing stricter library loading controls.

Workarounds

• Limit user permissions to prevent modifications to critical directories and environment variables
• Implement application control policies to restrict which libraries can be loaded
• Use SentinelOne's application control features to prevent unauthorized code execution
• Consider running Photoshop in a sandboxed environment for high-risk operations
• Ensure the system's PATH variable does not include user-writable directories before trusted system locations