CVE-2026-48388

This CVE presents as a DLL hijacking vulnerability in Adobe's installer software with an 8.6 HIGH CVSS score. But the 'user interaction required' metric is deeply misleading here. The interaction is not an extra click or dialog acceptance — it is simply running the installer, which users do millions of times daily as routine behavior. If your risk model treats 'user interaction' as a friction point that reduces severity, you are systematically underweighting installer-class vulnerabilities. The friction is zero. The real threat is supply chain compromise, not runtime exploitation. Adobe installers ship through CDN edge nodes, mirror sites, and third-party hosting at massive scale. Compromising one distribution channel propagates the hijacked installer to every user who downloads during that window. The EPSS score of 0.00173 captures active exploitation probability, but it completely misses the passive, persistent risk of supply chain injection that doesn't register as an 'exploit' until someone runs the installer. This vulnerability also carries a Scope: Changed designation, which limits successful exploitation to current user context. This is not a win — it reflects Windows Installer's built-in security hardening, which Microsoft implemented specifically because this attack vector was documented in their threat modeling guidance over two decades ago. Adobe's installer likely does not use MSI, meaning it runs outside that hardened context, which is why the ceiling is 'current user' rather than SYSTEM. The Scope: Changed label here is a reminder that Microsoft's installer platform partially mitigated this attack class while third-party tooling never caught up. What to do: First, verify whether your Adobe installer deployments use MSI-based installers or the legacy executable installer, as the attack surface differs materially. Second, audit your software distribution channels — CDN edges, internal mirrors, and third-party repos — for integrity verification mechanisms (hash validation, signed packages). Third, enable Sysmon event logging for DLL loading from non-standard paths within installer processes specifically; standard injection alerts tune this out as 'proof-of-concept.' Fourth, treat installer DLL hijacking as elevated priority regardless of CVSS — the blast radius scales with distribution reach, not exploit sophistication.

Reviewed through automated stages and approved by a human before publication.