Executive brief
A vulnerability in the Adobe Photoshop installer could allow a local user with limited permissions to gain full administrative control over a computer. By replacing temporary files during the installation process, an attacker can trick the installer into running malicious code with elevated system privileges. This requires a user to be actively running the Photoshop installer while the attacker is logged into the same machine.
Technical details
The Adobe Photoshop installer (Photoshop_Set-Up.exe) is vulnerable to an uncontrolled search path / binary planting vulnerability (CWE-427) during its execution. When installed via the Microsoft Store, the installer launches a second instance of itself with High Integrity privileges using the 'runas' verb. This elevated process downloads ZIP files to a user-writable temporary directory before extracting them into protected program folders. A local attacker with low privileges can replace these ZIP files or their contents before extraction, leading to the placement of malicious executables (such as Adobe installer.exe) into system directories. When the installer subsequently executes these files with High Integrity or System privileges, the attacker achieves arbitrary code execution and privilege escalation.
Affected products
- Adobe Photoshop Installer (Photoshop_Set-Up.exe) 2.11.0.30
Timeline
- 2025-09-23: disclosed: Initial disclosure to vendor
- 2026-01-20: patched: Vendor patch release
- 2026-04-15: advisory: Initial CVE publication
- 2026-04-22: other: Public release of technical report by Cisco Talos