CVE-2026-76199: Uncontrolled Search Path Element (CWE-427) in Adobe Photoshop 2026

CVE-2026-76199 is an Uncontrolled Search Path Element vulnerability in Adobe Photoshop 2026. This flaw allows an attacker to influence the search path used by the application, potentially leading to arbitrary code execution in the context of the current user. Exploitation requires the victim to open a malicious file, which triggers the vulnerability. The vulnerability affects Photoshop versions up to 27.6 and 26.11.6 inclusive. The CVSS v3.1 base score is 8.6, reflecting high impact on confidentiality, integrity, and availability with low attack complexity but requiring user interaction.

Successful exploitation of this vulnerability could result in arbitrary code execution with the privileges of the current user, potentially leading to full compromise of the affected system within the user's context. The changed scope indicates that the vulnerability may affect components beyond the initial process, increasing potential impact. However, exploitation requires user interaction, limiting remote automatic exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to prevent exploitation. No official patch or workaround information is provided in the current data.