Adobe Photoshop Installer contains a critical uncontrolled search path vulnerability that could allow an attacker to achieve arbitrary code execution on a victim's system.

This vulnerability is an uncontrolled search path element (CWE-427) where the installer searches for libraries in insecure locations. An attacker can exploit this by placing a malicious library in a directory the installer accesses, requiring a local user to execute the installer to trigger the payload.

The potential for arbitrary code execution poses a severe risk to organizational security, as it grants an attacker the ability to compromise the host system, escalate privileges, or deploy further malicious payloads. With a CVSS score of 8.2, this vulnerability is classified as High severity due to its potential for total system compromise, despite the requirement for user interaction.

Immediate Action: Restrict write access to directory paths utilized by the Photoshop Installer and ensure that only authorized software is installed from trusted sources.

Proactive Monitoring: Monitor system logs for unusual file creation or unexpected library loading events occurring during software installation processes.

Compensating Controls: Implement strict application control policies to prevent the execution of unauthorized binaries or libraries within the directories used by the installer.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, administrators should prioritize securing installer directories and educating users on the risks of running software from untrusted locations. Organizations should continue to monitor Adobe official security channels for the release of a definitive patch to resolve this search path flaw.