CVE-2026-48388 describes an Uncontrolled Search Path Element vulnerability in the Adobe Photoshop Installer. This vulnerability allows an attacker to execute arbitrary code by placing a malicious library in a directory that the installer searches during execution. Exploitation requires the victim to run the installer, making user interaction necessary. The vulnerability has a CVSS 3.1 base score of 8.6, reflecting high impact on confidentiality, integrity, and availability, and scope is changed, indicating the impact extends beyond the installer process. No vendor advisory or patch information is currently available.

Successful exploitation could lead to arbitrary code execution in the context of the current user running the installer, potentially compromising system confidentiality, integrity, and availability. The changed scope suggests that the impact could extend beyond the installer process itself. However, exploitation requires user interaction (running the installer). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running untrusted installers and ensure the installer is obtained from official sources. Monitor Adobe's security advisories for updates regarding patches or mitigations.