Product:
Creative Cloud Desktop
Summary
Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing unauthorized modifications to files. Exploitation of this issue does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.6 | CVE-2025-54271 |
Exploitation
An attacker can exploit this vulnerability by manipulating the timing of resource checks and usage. By executing a carefully timed sequence of operations, the attacker can gain unauthorized access to modify files on the system. This can be done without any user interaction, making it easier for low-privileged attackers to carry out the exploit.
Affected Products
- Creative Cloud Desktop versions 6.7.0.278 and earlier: Affected by a TOCTOU Race Condition vulnerability allowing arbitrary file system write.
Mitigation
To mitigate this vulnerability, users should update to the latest version of Creative Cloud Desktop. Adobe has released patches that address this issue, and it is recommended to apply these updates promptly to prevent potential exploitation.