CVE-2026-48388 Overview
CVE-2026-48388 affects the Adobe Photoshop Installer through an Uncontrolled Search Path Element weakness [CWE-427]. The installer loads a library from a directory an attacker can influence. An attacker who plants a malicious library in a searched directory can execute arbitrary code in the context of the user running the installer.
Exploitation requires user interaction because a victim must run the installer for the malicious library to load. The CVSS scope is changed, meaning the impact extends beyond the initially vulnerable component.
Critical Impact
Arbitrary code execution in the current user's context via a malicious library placed on the installer's search path.
Affected Products
- Adobe Photoshop Installer
Discovery Timeline
- 2026-07-28 - CVE-2026-48388 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-48388
Vulnerability Analysis
CVE-2026-48388 is an Uncontrolled Search Path Element issue in the Adobe Photoshop Installer. The installer resolves and loads one or more supporting libraries using a search path that includes directories a lower-privileged user can write to. When the installer runs, it locates the attacker-supplied binary before the intended library and loads it into the installer process.
Because the malicious library runs inside the installer, all code it contains executes with the privileges of the user launching the installer. The scope change reflected in the CVSS vector indicates the impact reaches resources beyond the installer's own security authority, such as user files, session tokens, or persistence locations.
Root Cause
The root cause is insecure library resolution during installation. The installer does not restrict its search path to trusted, non-writable directories, and it does not validate that loaded libraries originate from expected locations or carry a verified signature. This class of flaw is tracked as CWE-427: Uncontrolled Search Path Element.
Attack Vector
The attack vector is local. An attacker first stages a malicious dynamic library with a filename the installer will resolve, placing it in a directory the installer searches, such as the installer's working directory, the user's Downloads folder, or another location on the search path. The attacker then convinces the victim to run the Photoshop installer from that location. When the installer starts, it loads the attacker-controlled library and executes its initialization routine as the current user.
No authenticated network access is required. Common delivery techniques include bundling the malicious library alongside the installer in a shared archive, dropping it via a prior low-privilege foothold, or hosting both files on a file share.
Detection Methods for CVE-2026-48388
Indicators of Compromise
- Unsigned or unexpectedly signed DLL, .dylib, or .so files present in the same directory as the Photoshop installer executable.
- Photoshop installer process (Set-up.exe, Install.app, or equivalent) loading modules from user-writable paths such as Downloads, Temp, or removable media.
- Child processes of the installer spawning shells, script interpreters, or network utilities.
Detection Strategies
- Monitor image-load events where the Adobe Photoshop installer process loads libraries from non-standard, user-writable directories.
- Alert on installer binaries executed from paths that also contain unsigned libraries with names matching known Adobe or Windows system module names.
- Correlate installer execution with subsequent process creation events that spawn cmd.exe, powershell.exe, bash, or outbound network connections.
Monitoring Recommendations
- Enable module-load telemetry (Sysmon Event ID 7 on Windows, equivalent EDR image-load events on macOS) for installer processes.
- Track file-write events that drop .dll or .dylib files into directories immediately before an installer executes from the same location.
- Review software deployment logs to confirm Photoshop installers are launched only from managed, non-user-writable repositories.
How to Mitigate CVE-2026-48388
Immediate Actions Required
- Apply the Adobe security update for the Photoshop Installer as soon as it is available from Adobe's official channels.
- Only run the Photoshop installer from a clean, dedicated directory that contains no other files, ideally on a non-user-writable share.
- Verify the digital signature of the installer package before execution and confirm it is signed by Adobe.
- Restrict end-user ability to execute installers from Downloads, Temp, and removable media through application control policies.
Patch Information
Refer to Adobe's security bulletin for Photoshop for the fixed installer version. Replace any cached installer packages in software distribution systems with the patched build to prevent reuse of vulnerable installers.
Workarounds
- Distribute Photoshop installers through managed software deployment tools that stage the installer in an isolated, non-writable working directory.
- Enforce application allow-listing (WDAC, AppLocker, or macOS Gatekeeper policies) to block loading of unsigned libraries by installer processes.
- Educate users to never run installers from directories containing untrusted files such as email attachments or shared archives.
# Example: run the installer from an isolated directory on Windows
New-Item -ItemType Directory -Path C:\AdobeInstall -Force
Copy-Item .\Photoshop_Set-up.exe C:\AdobeInstall\
Get-AuthenticodeSignature C:\AdobeInstall\Photoshop_Set-up.exe
Start-Process C:\AdobeInstall\Photoshop_Set-up.exe
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
