CVE-2021-43019 HIGH

CVE-2021-43019: Adobe Creative Cloud Incorrect Permission Assignment Privilege Escalation Vulnerability

Vendor Adobe
Product Creative Cloud (desktop component)
Weakness CWE-732
Published November 23, 2021
Last update April 23, 2025

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Adobe Creative Cloud version 5.5 (and earlier) are affected by a privilege escalation vulnerability in the resources leveraged by the Setup.exe service. An unauthenticated attacker could leverage this vulnerability to remove files and escalate privileges under the context of SYSTEM . An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability on the product installer. User interaction is required before product installation to abuse this vulnerability.

Key dates

02Disclosure timeline

November 23, 2021 CVE published
April 23, 2025 Record updated