EUVD-2026-56832
GHSA-936w-xrph-634c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally (AV:L); no privileges needed to deliver the file (PR:N); user must actively open it (UI:R); full CIA impact from code execution as current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a crafted malicious file is opened. The vulnerability is rooted in improper memory boundary validation during file parsing (CWE-787), yielding full confidentiality, integrity, and availability impact per CVSS. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE-class severity and file-delivery vector make this a meaningful phishing or watering-hole risk for creative professionals.
Technical ContextAI
Adobe Lightroom Classic is a desktop digital asset management and photo-editing application targeting professional photographers. The vulnerability is classified as CWE-787 (Out-of-Bounds Write), a memory corruption class in which data is written beyond the allocated buffer boundary - a common root cause for code execution primitives in file-parsing code paths. The affected CPE-implied versions span Lightroom Classic ≤15.4.1, including 15.4, 15.3.1, 15.3, 15.2.1, and 15.2. File-parsing routines in imaging applications frequently operate on attacker-controlled data (image headers, metadata, compressed streams), providing wide opportunity to craft inputs that trigger a write primitive. Tags from the intelligence sources confirm this is a Buffer Overflow / Memory Corruption scenario leading to RCE, consistent with heap or stack smashing via maliciously structured image or catalog files.
RemediationAI
The primary fix is to upgrade Adobe Lightroom Classic to version 15.5, which Adobe confirmed as the patched release per advisory APSB26-94 (https://helpx.adobe.com/security/products/lightroom/apsb26-94.html). Updates can be applied via Adobe Creative Cloud desktop application. As a compensating control where immediate patching is not possible, users should avoid opening Lightroom-compatible files (RAW images, DNG, catalog files, etc.) received from untrusted or unexpected sources until the patch is applied; note that this significantly limits workflow and is not a sustainable long-term control. Organizations may also consider restricting file receipt channels (e.g., quarantine inbound files for scanning) or enforcing application allowlisting to limit exposure, though neither substitutes for patching. No meaningful network-level blocking applies given the local file-open attack vector.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today