CVE-2026-48287 describes an Untrusted Search Path vulnerability in Adobe's Content Credentials Rust SDK. This vulnerability could enable an attacker to execute arbitrary code within the context of the current user if the user interacts with malicious content such as a crafted URL or compromised web page. The attack requires user interaction and has a changed scope, indicating that the vulnerability affects resources beyond the initial component. The CVSS v3.1 base score is 7.4, reflecting high severity with local attack vector, high attack complexity, no privileges required, user interaction required, changed scope, and high impact on confidentiality and integrity but no impact on availability. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to arbitrary code execution in the context of the current user, potentially compromising confidentiality and integrity of user data. The attack requires user interaction and local access, limiting remote exploitation. There is no impact on system availability. The changed scope suggests the vulnerability affects components beyond the initial vulnerable module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted URLs or web content related to Adobe Content Credentials Rust SDK. No official fixes or temporary mitigations have been published by Adobe at this time.