CVE-2016-4158 describes an unquoted Windows search path vulnerability in Adobe Creative Cloud Desktop Application versions prior to 3.7.0.272 on Windows. This flaw allows a local attacker to achieve privilege escalation by placing a malicious executable in the %SYSTEMDRIVE% directory, which the application then executes due to improper path handling. Rated with a CVSS score of 7.3 (HIGH), this vulnerability has a low attack complexity and requires user interaction, but can lead to high impact on confidentiality, integrity, and availability. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB) and it is not listed in CISA's KEV catalog, there was some media coverage and community discussion at the time, including a SecurityWeek article mentioning a Flash zero-day exploited in targeted attacks.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* | ||
<= 3.6.0.248CPE matchmatch criteria | cpe:2.3:a:adobe:creative_cloud:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.