Loading story…
Adobe disclosed CVE-2026-48388, a high-severity flaw in the Photoshop Installer caused by an uncontrolled search path element (CWE-427). The issue allows a local attacker to place a malicious DLL or library in a directory searched by the installer so that, when a victim runs the installer, attacker-controlled code is loaded and executed in the context of the current user. The vulnerability is not remotely exploitable on its own, but it does require user interaction and can become more serious when installations are performed with elevated privileges.
Advisories warn that the installer may search user-writable locations before legitimate Windows system directories, creating a classic DLL hijacking condition. Organizations are being urged to update to the latest Adobe Photoshop release containing the patched installer, obtain installers only from official Adobe sources, remove suspicious libraries from searchable paths, enforce application allowlisting and stricter DLL search-order controls, and use least-privilege accounts during software installation.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A high-severity uncontrolled search path element (DLL hijacking) vulnerability affecting the Adobe Photoshop Installer was disclosed as CVE-2026-48388. The flaw can allow arbitrary code execution in the context of the user running the installer if a malicious library is placed in a searched directory, and guidance was issued to update to a patched version and use trusted installation sources.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Adobe patched a local privilege escalation vulnerability in **Creative Cloud Desktop** for macOS that allowed a local attacker to gain **root** privileges through the product's privileged helper daemon, `/Library/PrivilegedHelperTools/com.adobe.acc.installer`. The issue, tracked as `CVE-2018-4991` and addressed in Adobe Security Bulletin **APSB18-12**, affected an XPC method that could launch processes as root while relying on insufficient caller validation. Technical analysis showed the helper's `codesign`-based trust check was vulnerable to a time-of-check/time-of-use race condition, allowing an attacker to swap a validated binary before execution or abuse trusted Adobe-signed interpreters such as Node.js to run arbitrary code with elevated privileges. Adobe's fix removed the flawed signature-checking logic and tightened the code-signing requirement used to authorize requests, while the researcher warned that similar patterns might exist in other Adobe components.
Aug 1, 2026
Western Digital disclosed **CVE-2025-30248**, a **DLL search order hijacking** flaw in the *WD Discovery* desktop app installer on Windows that can allow **local arbitrary code execution**. The issue affects **WD Discovery 5.2.730 and earlier**, where an attacker can place a crafted DLL in the installer’s search path so the legitimate installer loads and executes it, running attacker code with the installer’s privileges; the weakness maps to **CWE-427**. Western Digital also reported additional **EXE/DLL hijacking** issues in the product’s **Tiny Installer** component, increasing the number of potential local execution paths. Western Digital rated the vulnerability **HIGH** (reported as **CVSS v4.0 8.9**), and released **WD Discovery 5.3** to address the issues; users are advised to update to 5.3 via the application’s update mechanism or by downloading the latest installer from Western Digital’s official site.
Jun 29, 2026
Adobe released security updates for **Photoshop**, **Substance 3D Stager**, **Illustrator on iPad**, **Animate**, and **Substance 3D Designer** to fix **14 critical vulnerabilities** that could allow **arbitrary code execution**. The issues affect older versions of the products and stem from flaws that can be triggered when a user opens a specially crafted malicious file, giving a remote unauthenticated attacker a path to compromise a targeted system. Adobe advised customers to upgrade immediately to patched versions including **Photoshop 26.2/25.12.1**, **Substance 3D Stager 3.1.0**, **Illustrator on iPad 3.0.8**, **Animate 23.0.10/24.0.7**, and **Substance 3D Designer 14.1**. CSIRT.SK highlighted that exploitation requires user interaction to download and open the malicious content, but the bugs were rated critical because successful exploitation could result in code execution on affected devices.
Jul 24, 2026