Talos Vulnerability Report

Summary

A privilege escalation vulnerability exists in the Installation functionality of Photoshop (version(s): Photoshop_Set-Up.exe version 2.11.0.30). A specially crafted malformed file can lead to privilege escalation. An attacker can replace with a malicious file to trigger this vulnerability.

Confirmed Vulnerable Versions

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Photoshop (version(s): Photoshop_Set-Up.exe version 2.11.0.30)

Product URLs

Photoshop - https://www.adobe.com/products/photoshop.html

CVSSv3 Score

8.2 - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-427 - Uncontrolled Search Path Element

Details

Adobe Photoshop is a powerful software for image creation, photo editing, and graphic design. It provides advanced tools for photo retouching, compositing, digital painting, and creating stunning visual effects. It is one of the most widely used tools for professional digital art.

Adobe Photoshop is vulnerable to a privilege escalation issue when installed via the Microsoft Store application. When a user attempts to install Adobe Photoshop, the following events occur in the background:

• WindowsPackageManagerServer.exe downloads and runs Photoshop_Set-Up.exe.

   11:48:33.7206943 AM	WindowsPackageManagerServer.exe	5144	CreateFile	C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\Photoshop_Set-Up.exe	NAME NOT FOUND	Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a	DESKTOP-JNJPO4R\dev	Medium
  
   [...]
  
   11:49:43.2552424 AM	WindowsPackageManagerServer.exe	5144	SetRenameInformationFile	C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\cebaae87bd3f085db4216cca6d0397a927ad71788f24314150d7a185dc21018b	SUCCESS	ReplaceIfExists: True, FileName: C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\Photoshop_Set-Up.exe	DESKTOP-JNJPO4R\dev	Medium
  

• Photoshop_Set-Up.exe calls ShellExecute with the runas verb to launch a second instance of Photoshop_Set-Up.exe with elevated privileges.

• Once permission is granted, the new Photoshop_Set-Up.exe process runs with High Integrity privileges.

    11:49:52.1230695 AM	Photoshop_Set-Up.exe	8724	Process Create	C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\Photoshop_Set-Up.exe	SUCCESS	PID: 9536, Command line: "C:\Users\dev\AppData\  Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\Photoshop_Set-Up.exe" --pipename={1AEFEEE0-1E3B-4B53-9E4C-30A9823A79B1} --pid=8724 --locale=en_US --mode=stub	DESKTOP-JNJPO4R\dev	Medium
  
    11:49:52.1230816 AM	Photoshop_Set-Up.exe	9536	Process Start		SUCCESS	Parent PID: 8724, Command line: "C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\Photoshop_Set-Up.exe" --pipename={1AEFEEE0-1E3B-4B53-9E4C-30A9823A79B1} --pid=8724 --locale=en_US --mode=stub, Current directory: C:\Users\dev\AppData\Local\Temp\WinGet\XPFD4T9N395QN6.6.0.0.571\, Environment: 
        [...]	High
  

• This elevated process downloads zip files to a temporary folder, then extracts and saves them to the program folder. The patch for TALOS-2025-2274 fixes the permissions of the temporary folder so that only high-privilege users can write to it.
• After copying files to the program folder, it runs additional executables such as Adobe installer.exe and AdobeServiceInstaller.exe with High Integrity privileges to configure the application.

The vulnerability exists because Photoshop_Set-Up.exe, after copying Adobe Installer.exe, searches for it first in the %TEMP%\winget folder, as shown in the following Process Monitor logs:

11:51:30.7114936 AM	Photoshop_Set-Up.exe	9536	CreateFile	C:\Users\dev\AppData\Local\Temp\WinGet\ElevationManager\Adobe Installer.exe	PATH NOT FOUND	Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a	DESKTOP-JNJPO4R\dev	High

When it is not found there, it searches in the Program Files (x86)\Common Files folder:

11:51:30.7120268 AM	Photoshop_Set-Up.exe	9536	CreateFile	C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\Adobe Installer.exe	SUCCESS	Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened	DESKTOP-JNJPO4R\dev	High

In this case, %TEMP%\winget\ is writable by a standard user. An attacker with user-level privileges can exploit this by placing a malicious file named Adobe Installer.exe in that directory. When the installer attempts to run Adobe Installer.exe, it will instead execute the attacker-controlled file with HIGH integrity privileges.

The Process Monitor log below shows the creation of C:\pwned.txt when the attacker-controlled Adobe Installer.exe is executed. Note that only a high-privilege user can create a file in the root directory.

11:19:04.6701753 AM	Adobe Installer.exe	10676	CreateFile	C:\pwned.txt	SUCCESS	Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: 0, OpenResult: Overwritten	DESKTOP-JNJPO4R\dev	High


11:19:04.6861686 AM	Adobe Installer.exe	10676	WriteFile	C:\pwned.txt	SUCCESS	Offset: 0, Length: 23, Priority: Normal	DESKTOP-JNJPO4R\dev	High

11:19:04.6862690 AM	Adobe Installer.exe	10676	CloseFile	C:\pwned.txt	SUCCESS		DESKTOP-JNJPO4R\dev	High

By exploiting this vulnerability, a user can gain SYSTEM privileges.

This vulnerability is a patch bypass of TALOS-2025-2274. Adobe does not maintain versioning for the Photoshop installer, so the installer version was not updated even after the TALOS-2025-2274 patch was applied.

Vendor Response (CVE-2026-48388)

Vendor Link: https://www.cve.org/CVERecord?id=CVE-2026-48388

Timeline

2026-04-22 - Initial Vendor Contact
2026-04-22 - Vendor Disclosure
2026-07-28 - Vendor Patch Release
2026-07-28 - Public Release