TALOS-2026-2360

CVE-2026-48388

A privilege escalation vulnerability exists in the Installation functionality of Photoshop (version(s): Photoshop_Set-Up.exe version 2.11.0.30). A specially crafted malformed file can lead to privilege escalation. An attacker can replace with a malicious file to trigger this vulnerability.

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Photoshop (version(s): Photoshop_Set-Up.exe version 2.11.0.30)

Photoshop – https://www.adobe.com/products/photoshop.html

8.2 – CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE-427 – Uncontrolled Search Path Element

Adobe Photoshop is a powerful software for image creation, photo editing, and graphic design. It provides advanced tools for photo retouching, compositing, digital painting, and creating stunning visual effects. It is one of the most widely used tools for professional digital art.

Adobe Photoshop is vulnerable to a privilege escalation issue when installed via the Microsoft Store application. When a user attempts to install Adobe Photoshop, the following events occur in the background:

`WindowsPackageManagerServer.exe` downloads and runs `Photoshop_Set-Up.exe`.

“`
11:48:33.7206943 AM WindowsPackageManagerServer.exe 5144 CreateFile C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571Photoshop_Set-Up.exe NAME NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a DESKTOP-JNJPO4Rdev Medium […] 11:49:43.2552424 AM WindowsPackageManagerServer.exe 5144 SetRenameInformationFile C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571cebaae87bd3f085db4216cca6d0397a927ad71788f24314150d7a185dc21018b SUCCESS ReplaceIfExists: True, FileName: C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571Photoshop_Set-Up.exe DESKTOP-JNJPO4Rdev Medium
“`

`Photoshop_Set-Up.execalls` `ShellExecutewith the` `runasverb to launch a second instance of` `Photoshop_Set-Up.exewith elevated privileges.`

Once permission is granted, the new `Photoshop_Set-Up.exe` process runs with `High Integrity` privileges.

“`
11:49:52.1230695 AM Photoshop_Set-Up.exe 8724 Process Create C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571Photoshop_Set-Up.exe SUCCESS PID: 9536, Command line: “C:UsersdevAppData LocalTempWinGetXPFD4T9N395QN6.6.0.0.571Photoshop_Set-Up.exe” –pipename={1AEFEEE0-1E3B-4B53-9E4C-30A9823A79B1} –pid=8724 –locale=en_US –mode=stub DESKTOP-JNJPO4Rdev Medium 11:49:52.1230816 AM Photoshop_Set-Up.exe 9536 Process Start SUCCESS Parent PID: 8724, Command line: “C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571Photoshop_Set-Up.exe” –pipename={1AEFEEE0-1E3B-4B53-9E4C-30A9823A79B1} –pid=8724 –locale=en_US –mode=stub, Current directory: C:UsersdevAppDataLocalTempWinGetXPFD4T9N395QN6.6.0.0.571, Environment: […] High
“`

`TALOS-2025-2274fixes the permissions of the temporary folder so that only high-privilege users can write to it.` `Adobe installer.exeand` `AdobeServiceInstaller.exewith` `High Integrityprivileges to configure the application.`

The vulnerability exists because `Photoshop_Set-Up.exe`, after copying `Adobe Installer.exe`, searches for it first in the `%TEMP%winget` folder, as shown in the following `Process Monitor` logs:

“`
11:51:30.7114936 AM Photoshop_Set-Up.exe 9536 CreateFile C:UsersdevAppDataLocalTempWinGetElevationManagerAdobe Installer.exe PATH NOT FOUND Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a DESKTOP-JNJPO4Rdev High
“`

When it is not found there, it searches in the `Program Files (x86)Common Files` folder:

“`
11:51:30.7120268 AM Photoshop_Set-Up.exe 9536 CreateFile C:Program Files (x86)Common FilesAdobeAdobe Desktop CommonElevationManagerAdobe Installer.exe SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened DESKTOP-JNJPO4Rdev High
“`

In this case, `%TEMP%winget` is writable by a standard user. An attacker with user-level privileges can exploit this by placing a malicious file named `Adobe Installer.exe` in that directory. When the installer attempts to run `Adobe Installer.exe`, it will instead execute the attacker-controlled file with `HIGH integrity` privileges.

The `Process Monitor` log below shows the creation of `C:pwned.txt` when the attacker-controlled `Adobe Installer.exe` is executed. Note that only a high-privilege user can create a file in the root directory.

“`
11:19:04.6701753 AM Adobe Installer.exe 10676 CreateFile C:pwned.txt SUCCESS Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten DESKTOP-JNJPO4Rdev High 11:19:04.6861686 AM Adobe Installer.exe 10676 WriteFile C:pwned.txt SUCCESS Offset: 0, Length: 23, Priority: Normal DESKTOP-JNJPO4Rdev High 11:19:04.6862690 AM Adobe Installer.exe 10676 CloseFile C:pwned.txt SUCCESS DESKTOP-JNJPO4Rdev High
“`

By exploiting this vulnerability, a user can gain SYSTEM privileges.

This vulnerability is a patch bypass of `TALOS-2025-2274`. Adobe does not maintain versioning for the Photoshop installer, so the installer version was not updated even after the `TALOS-2025-2274` patch was applied.

Vendor Link: https://www.cve.org/CVERecord?id=CVE-2026-48388

2026-04-22 – Initial Vendor Contact

2026-04-22 – Vendor Disclosure

2026-07-28 – Vendor Patch Release

2026-07-28 – Public Release

KPC of Cisco Talos