CVE-2025-21127: Adobe Photoshop RCE Vulnerability

CVE-2025-21127 Overview

CVE-2025-21127 is an Uncontrolled Search Path Element vulnerability [CWE-427] affecting Adobe Photoshop Desktop versions 25.12, 26.1, and earlier. An attacker who can influence the search path environment variable can cause Photoshop to load a malicious library at runtime. Successful exploitation results in arbitrary code execution in the context of the user running the application. Exploitation requires user interaction: the victim must launch the vulnerable Photoshop application. The flaw affects installations on both Microsoft Windows and Apple macOS.

Critical Impact
Arbitrary code execution in the user's security context through malicious library loading when Photoshop is launched.

Affected Products

Adobe Photoshop Desktop 25.12 and earlier
Adobe Photoshop Desktop 26.1 and earlier
Microsoft Windows and Apple macOS host platforms

Discovery Timeline

2025-01-14 - CVE-2025-21127 published to the National Vulnerability Database (NVD)
2025-01-14 - Adobe publishes Security Advisory APSB25-02 with fixed versions
2025-02-11 - Last updated in the NVD database

Technical Details for CVE-2025-21127

Vulnerability Analysis

The vulnerability stems from how Adobe Photoshop resolves the location of dynamically loaded libraries at process startup. Photoshop relies on directories referenced through the operating system search path without sufficiently constraining or validating those locations. When a directory under attacker control appears earlier in the search order than the legitimate library directory, the application loads the attacker-supplied library instead of the intended one.

Because the loaded module runs inside the Photoshop process, the attacker inherits the privileges of the user launching the application. The issue is classified as Uncontrolled Search Path Element [CWE-427], a class of weakness commonly referred to as DLL search-order hijacking on Windows and dylib hijacking on macOS. The attack is local, requires no privileges, and depends on the victim launching Photoshop after the malicious library has been staged.

Root Cause

The root cause is improper control of the library search path. Photoshop does not pin loads to absolute, trusted paths for all of its dependent modules, and it honors directories supplied through environment variables such as PATH, DYLD_LIBRARY_PATH, or the current working directory. An attacker who can write to any directory referenced by these variables can place a library with a name that Photoshop will search for during initialization.

Attack Vector

An attacker first places a crafted dynamic library in a directory that appears in Photoshop's effective search path. The attacker then modifies an environment variable, drops the file into the application directory, or stages it in a per-user writable location. When the victim launches Photoshop, the loader resolves the dependency to the malicious file and executes its initialization routine. Code in that routine runs with the user's privileges and can persist, harvest credentials, or stage further payloads. Delivery typically occurs through phishing attachments, malicious software bundles, or compromised shared workstations.

No verified public proof-of-concept code is available. The exploitation pattern follows the standard search-order hijacking technique: a malicious .dll on Windows or .dylib on macOS is named to match a library Photoshop attempts to load and is placed in a directory that the loader inspects before the legitimate installation path.

Detection Methods for CVE-2025-21127

Indicators of Compromise

Unsigned or unexpectedly signed .dll or .dylib files in the Photoshop installation directory or in user-writable directories on the system PATH.
Photoshop process (Photoshop.exe or Adobe Photoshop) loading modules from non-standard paths such as user profile, temp, or download directories.
Recent modification of environment variables (PATH, DYLD_LIBRARY_PATH, DYLD_INSERT_LIBRARIES) on workstations running Photoshop.

Detection Strategies

Monitor image load events for the Photoshop process and alert when the loaded module path is outside the official Adobe install directory.
Hunt for newly created libraries in directories writable by standard users that share names with legitimate Photoshop dependencies.
Correlate Photoshop launches with child process creation that is inconsistent with normal application behavior, such as cmd.exe, powershell.exe, or bash spawned shortly after startup.

Monitoring Recommendations

Enable module-load auditing on endpoints and forward events to a central analytics platform for baseline comparison.
Track changes to user and system environment variables on developer and creative workstations.
Apply file integrity monitoring to the Adobe Photoshop installation directory to catch unauthorized library drops.

How to Mitigate CVE-2025-21127

Immediate Actions Required

Update Adobe Photoshop to the fixed versions identified in Adobe Security Advisory APSB25-02.
Inventory endpoints running Photoshop 25.12, 26.1, or earlier and prioritize patching of shared and high-value creative workstations.
Restrict standard user write access to directories referenced by the system search path.

Patch Information

Adobe addressed CVE-2025-21127 in the January 2025 Photoshop security update. Fixed versions and download links are published in Adobe Security Advisory APSB25-02. Administrators should deploy the update through Adobe Creative Cloud or their managed software distribution tooling.

Workarounds

Remove writable directories from the system PATH and audit per-user environment variables for entries pointing to user-writable locations.
Enforce application allow-listing so only Adobe-signed libraries can load into the Photoshop process.
Avoid launching Photoshop from untrusted working directories such as downloaded archive folders or removable media.

bash

# Example: audit Windows PATH entries for user-writable directories
# Run in an elevated PowerShell session
$env:Path -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $writable = $acl.Access | Where-Object {
            $_.IdentityReference -match 'Users|Everyone|Authenticated' -and
            $_.FileSystemRights -match 'Write|Modify|FullControl'
        }
        if ($writable) { Write-Output "User-writable PATH entry: $_" }
    }
}