How severe is CVE-2025-21162?

CVE-2025-21162 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2025-21162 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-21162?

CVE-2025-21162 affects Adobe Photoshop Elements. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-21162?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-21162 have an EU (EUVD) identifier?

Yes. CVE-2025-21162 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-2254.

When was CVE-2025-21162 published?

CVE-2025-21162 was published on 2025-02-11 and last updated on 2026-06-17.

CVE-2025-21162

CVE-2025-21162 is a medium-severity vulnerability in Adobe Photoshop Elements with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-379.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-2254
Weakness: CWE-379
Affected product: Adobe Photoshop Elements
Published: 2025-02-11
Last modified: 2026-06-17

Description

Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Frequently asked questions

What is CVE-2025-21162?: Photoshop Elements versions 2025.0 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could result in privilege escalation in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
How severe is CVE-2025-21162?: CVE-2025-21162 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2025-21162 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-21162?: CVE-2025-21162 affects Adobe Photoshop Elements. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-21162?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-21162 have an EU (EUVD) identifier?: Yes. CVE-2025-21162 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-2254.
When was CVE-2025-21162 published?: CVE-2025-21162 was published on 2025-02-11 and last updated on 2026-06-17.

References

https://helpx.adobe.com/security/products/photoshop_elements/apsb25-13.html

Affected products (1)

cpe:2.3:a:adobe:photoshop_elements:2025.0:*:*:*:*:*:*:*

More vulnerabilities in Adobe Photoshop Elements

CVE-2011-2443 — Critical (CVSS 9.3): Multiple buffer overflows in Adobe Photoshop Elements 8.0 and earlier allow remote attackers to cause a denial of…
CVE-2007-2365 — Critical (CVSS 9.3): Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows…
CVE-2021-39825 — High (CVSS 7.8): Photoshop Elements versions 2021 build 19.0 (20210304.m.156367) (and earlier) are affected by an out-of-bounds write…
CVE-2009-3489 — High (CVSS 7.8): Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 service with an insecure security descriptor,…
CVE-2021-28597 — Medium (CVSS 5.5): Adobe Photoshop Elements version 5.2 (and earlier) is affected by an insecure temporary file creation vulnerability. An…

All CVEs affecting Adobe Photoshop Elements →

Other CWE-379 vulnerabilities

CVE-2024-9950 — High (CVSS 7.8): A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify…
CVE-2024-9500 — High (CVSS 7.8): A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer…
CVE-2023-6080 — High (CVSS 7.8): Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation…
CVE-2023-3181 — High (CVSS 7.8): The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at…
CVE-2023-37243 — High (CVSS 7.8): The C:\Windows\Temp\Agent.Package.Availability\Agent.Package.Availability.exe file is automatically launched as SYSTEM…
CVE-2023-26396 — High (CVSS 7.8): Adobe Acrobat Reader versions 23.001.20093 (and earlier) and 20.005.30441 (and earlier) are affected by a Creation of…

Browse all CWE-379 vulnerabilities →