EUVD-2026-56836
GHSA-99jh-r6f5-x43g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing flaw triggered locally on victim open; attacker needs no system privileges to craft payload; mandatory user interaction confirmed by file-open requirement.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens a specially crafted malicious file, exploiting an out-of-bounds write flaw in the application's file parsing logic. The vulnerability executes at the privilege level of the current user, meaning full compromise of user-accessible data and processes without requiring elevation. No public exploit code has been identified at time of analysis and the vulnerability is absent from the CISA KEV catalog; however, file-based delivery against creative professionals - a population that routinely opens files from clients, stock libraries, and external collaborators - represents a realistic social-engineering attack surface.
Technical ContextAI
The root cause is CWE-787 (Out-of-Bounds Write), a memory-safety defect in which the application writes data beyond the bounds of an allocated buffer during file parsing. This class of flaw arises when length or offset values derived from attacker-controlled file content are not properly validated before being used to index into memory, allowing an attacker to corrupt adjacent heap or stack structures. Adobe Lightroom Classic is a desktop digital photography workflow application that parses a broad array of image and metadata formats (RAW, DNG, XMP, and others), each representing a potential parsing attack surface. Affected CPE-equivalent versions span Lightroom Classic 15.2 through 15.4.1 on all supported platforms, as confirmed by Adobe PSIRT and the EUVD entry EUVD-2026-56836. The CVSS vector AV:L confirms the exploit path is local execution triggered by file open rather than a network-reachable service.
RemediationAI
The primary fix is to upgrade Adobe Lightroom Classic to version 15.5, which is confirmed as the patched release per Adobe APSB26-94 (https://helpx.adobe.com/security/products/lightroom/apsb26-94.html) and the EUVD affected-versions data. Users should apply this update via the Adobe Creative Cloud desktop application. As a compensating control where immediate upgrade is not possible, users should refrain from opening image files received from untrusted or unverified sources in Lightroom Classic, and consider using an isolated or sandboxed environment for inspecting externally sourced files. Blocking execution of Lightroom Classic via application control policies for non-essential users is an additional organizational mitigation, though this will disrupt legitimate workflows. No alternative workaround eliminating the parsing vulnerability without patching is available.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today