EUVD-2026-56834
GHSA-662w-fxcw-cxx2
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
File-based local delivery mandates AV:L and UI:R; unpredictable runtime conditions justify AC:H; no credentials needed by attacker (PR:N); scope change to adjacent processes confirmed by S:C.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Lightroom Classic versions up to 15.4.1 is achievable when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled code to execute in the context of the current user. The attack scope extends beyond the application boundary (S:C), amplifying impact to potentially affect the underlying OS or co-running user-context processes. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based delivery model and creative professional user base make this a targeted phishing risk.
Technical ContextAI
CWE-863 (Incorrect Authorization) describes a flaw where the software performs an authorization check during resource access or operation execution but evaluates it incorrectly - allowing actions that should be restricted. In Lightroom Classic, this manifests during the processing of a crafted file, where authorization logic governing code execution pathways is bypassed or incorrectly evaluated. The affected product versions span Lightroom Classic 15.2 through 15.4.1, as confirmed by EUVD-2026-56834 and Adobe PSIRT. The CVSS S:C (Scope Changed) designation indicates the exploited vulnerability's impact crosses the security boundary of the Lightroom Classic component itself, reaching adjacent user-level processes or OS interfaces. The CWE-863 root cause is distinct from injection or memory corruption - the flaw lies in the authorization decision logic applied to file-triggered operations.
RemediationAI
The primary remediation is to upgrade to Adobe Lightroom Classic 15.5, which resolves this vulnerability per the Adobe PSIRT advisory APSB26-94 (https://helpx.adobe.com/security/products/lightroom/apsb26-94.html). If immediate upgrade is not feasible, the most effective compensating control is a strict policy prohibiting users from opening Lightroom-compatible files (DNG, PSD, TIFF, JPEG, etc.) received from untrusted or unverified sources - this directly addresses the UI:R prerequisite. Additionally, deploying application-level sandboxing or OS-level sandboxing (such as macOS App Sandbox or Windows Defender Application Guard) for Lightroom Classic processes can limit the blast radius of successful exploitation by constraining the scope-changed code execution. Note that user education alone, without technical enforcement, is insufficient given the file-based delivery mechanism common in creative industry workflows.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today