Photoshop Installer Vulnerability Allows Arbitrary Code Execution

The National Vulnerability Database (NVD) recently detailed CVE-2026-34632, a high-severity vulnerability affecting the Adobe Photoshop Installer. This flaw, categorized as an Uncontrolled Search Path Element (CWE-427), could enable a low-privileged local attacker to achieve arbitrary code execution in the context of the current user. Essentially, an attacker could manipulate the search path the installer uses to find critical resources, tricking it into executing malicious code instead.

While the CVSS score of 8.2 (HIGH) is concerning, it’s important to note that exploitation isn’t entirely silent. According to the NVD, user interaction is required; specifically, a user must be actively running the Photoshop installer for the vulnerability to be triggered. This mitigates some of the immediate ‘lights out’ threat, but it’s still a significant risk, especially in environments where users frequently install or update software.