EUVD-2026-56831
GHSA-fx9q-m22m-m24f
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
File-open exploit requires local delivery and active user interaction (AV:L, UI:R); attacker needs no system privileges (PR:N); scope change (S:C) reflects code execution reaching beyond the Lightroom process.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution in the context of the authenticated user when a victim opens a specially crafted file. Classified as CWE-502, this file-format exploit carries a CVSS 3.1 score of 8.6 with changed scope (S:C), indicating impact extends beyond the Lightroom process itself to broader user-accessible system resources. No public exploit identified at time of analysis and no CISA KEV listing; Adobe has released a fix in version 15.5 via security bulletin APSB26-94.
Technical ContextAI
Adobe Lightroom Classic is a professional photo-editing and cataloging application widely used among photographers and creative professionals. The vulnerability resides in the application's file-parsing subsystem, which deserializes data from user-supplied catalog or project files without adequate validation. CWE-502 (Deserialization of Untrusted Data) is a root-cause class where an application reconstructs objects from serialized byte streams; when that data is attacker-controlled, malicious payloads - often exploiting gadget chains present in the application's own object model or its dependencies - can trigger arbitrary code execution during the deserialization process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:C) is consistent with file-format exploits: the attacker does not need privileges on the victim machine but must deliver the malicious file locally and induce the user to open it. The changed scope (S:C) indicates that post-exploitation impact extends beyond the Lightroom process, reaching user-accessible OS resources, credentials, and other application data. Affected versions per EUVD-2026-56831 include Lightroom Classic 15.4, 15.4.1, 15.3, 15.3.1, 15.2, and 15.2.1, with the fix delivered in 15.5.
RemediationAI
Vendor-released patch: Lightroom Classic 15.5. Users and administrators should upgrade to Lightroom Classic 15.5 immediately using the Adobe Creative Cloud desktop application or the Adobe Update Manager; full details are in Adobe security bulletin APSB26-94 (https://helpx.adobe.com/security/products/lightroom/apsb26-94.html). For systems where immediate patching is not feasible, implement the following compensating controls: instruct users never to open Lightroom catalog (.lrcat), project, or associated data files received from untrusted sources, including email attachments, file-sharing links, and downloaded archives - this directly addresses the UI:R dependency. Configure email gateway and endpoint DLP policies to quarantine or strip Lightroom-associated file extensions (.lrcat, .lrtemplate) in inbound messages, though this does not protect against files obtained via browser downloads or cloud storage. Restricting Lightroom's file-type associations at the OS level can reduce inadvertent double-click execution. Note that none of these workarounds eliminate the vulnerability - they only reduce the attack surface; patching to 15.5 remains the only definitive remediation.
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today