Adobe Photoshop Installer contains an uncontrolled search path element vulnerability (CWE-427) that could lead to arbitrary code execution under the context of the current user. A local attacker with low privileges could exploit this by altering the search path the installer uses to find critical resources, potentially causing unauthorized code execution. Exploitation requires the user to run the installer, making user interaction necessary. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with low attack complexity, low privileges required, and user interaction needed. The vulnerability affects the installer component and is not related to a cloud service. No patch or official remediation level has been disclosed by Adobe as of the publication date.

Successful exploitation could result in arbitrary code execution with the privileges of the user running the Adobe Photoshop Installer, potentially compromising confidentiality, integrity, and availability of the affected system. Because the attacker requires local access and user interaction, the risk is limited to scenarios where a user executes the installer under manipulated conditions. There are no known exploits in the wild, which reduces immediate risk but does not eliminate it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running the Adobe Photoshop Installer from untrusted sources or environments where the search path could be manipulated by an attacker. Monitor Adobe's security advisories for updates regarding patches or official mitigations.