CVE-2016-4157 is an untrusted search path vulnerability in the installer for Adobe Creative Cloud Desktop Application versions prior to 3.7.0.272 on Windows. This flaw allows a local attacker to gain elevated privileges by introducing a malicious resource into an unspecified directory. With a CVSS score of 7.3 (High), exploitation requires local access and user interaction, but can lead to high impact on confidentiality, integrity, and availability. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, including a SecurityWeek article mentioning its exploitation in targeted attacks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.6.0.248CPE matchmatch criteria | cpe:2.3:a:adobe:creative_cloud:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.