EUVD-2026-56827
GHSA-q7jf-864h-xw7v
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-based local delivery requires no attacker privileges (PR:N), victim must actively open the crafted file (UI:R), with full user-context impact and no scope change (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a victim into opening a specially crafted malicious file, exploiting an integer overflow in the application's file parsing logic (CWE-190). The flaw yields full compromise of confidentiality, integrity, and availability within the current user's context, consistent with the CVSS 7.8 score. Adobe has released a patch in version 15.5 per advisory APSB26-94; no public exploit has been identified at time of analysis.
Technical ContextAI
CWE-190 (Integer Overflow or Wraparound) arises when arithmetic on integer values produces results exceeding the type's representable range, wrapping to unexpected values. In desktop creative applications such as Lightroom Classic, this class of flaw commonly manifests in size or offset calculations during file format parsing - for example, when computing buffer allocation sizes or loop bounds from attacker-controlled values embedded in image or raw camera file headers. The resulting memory corruption can redirect execution to attacker-controlled code. Lightroom Classic processes a broad range of proprietary camera raw formats and standard image formats, making its parser surface a historically targeted attack class. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U reflects that the malicious file must reach the local filesystem and the victim must actively open it, with no attacker-side privilege requirement and no scope change beyond the user's session.
RemediationAI
Vendor-released patch: Lightroom Classic 15.5. All installations of affected versions should be upgraded to 15.5 or later via the Adobe Creative Cloud desktop application or by following the guidance in advisory APSB26-94 at https://helpx.adobe.com/security/products/lightroom/apsb26-94.html. Where immediate patching is not operationally feasible, organizations should consider configuring email gateway and web proxy policies to quarantine or flag common raw image formats (CR2, CR3, ARW, NEF, DNG, and similar) received from external senders - a measure that reduces the social engineering delivery surface but may intercept legitimate client asset transfers and requires workflow coordination. User awareness training focused on not opening image files from unknown or unsolicited sources provides an additional behavioral control. None of these mitigations eliminate the underlying vulnerability; patching to 15.5 remains the definitive fix.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today