EUVD-2026-56833
GHSA-xw65-fhx6-6xqp
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing trigger requires local file open (AV:L, UI:R); no attacker privileges needed; full memory corruption impact across C/I/A with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of the logged-in user when a victim opens a specially crafted file. Tagged as Memory Corruption, RCE, and Buffer Overflow by Adobe PSIRT, the vulnerability carries a CVSS 7.8 (High) rating. No public exploit or CISA KEV listing has been identified at time of analysis, but the file-based attack vector makes it suitable for phishing and malicious download campaigns targeting creative professionals.
Technical ContextAI
The root cause is CWE-787 (Out-of-Bounds Write), a memory corruption class where the application writes data past the end of an allocated buffer during file parsing. Lightroom Classic's image/file ingestion pipeline processes a wide range of media formats, and a maliciously crafted file can trigger a write primitive beyond buffer boundaries, corrupting adjacent memory. On modern systems this may defeat heap integrity checks and ultimately redirect code execution. The CVSS attack vector is Local (AV:L), consistent with a file-parsing trigger where the exploit payload is delivered via a file opened by the application rather than over the network directly. Affected CPE-implied components cover Adobe Lightroom Classic versions 15.2 through 15.4.1.
RemediationAI
The primary remediation is to upgrade Adobe Lightroom Classic to version 15.5, which is the vendor-released patch per Adobe security bulletin APSB26-94 (https://helpx.adobe.com/security/products/lightroom/apsb26-94.html). Updates can be applied through the Adobe Creative Cloud desktop application. As a compensating control prior to patching, organizations should advise users not to open Lightroom-compatible files (RAW images, DNG, PSD, etc.) received from untrusted sources such as unsolicited email attachments or unfamiliar download links. Email gateway filtering to block bulk image archive attachments reduces delivery surface, though this may impact legitimate creative workflows. Endpoint detection rules for anomalous child process spawning from the Lightroom Classic process can help detect exploitation attempts.
Unsafe deserialization of untrusted data in Adobe Lightroom Classic (versions ≤15.4.1) enables arbitrary code execution
Path traversal in Adobe Lightroom Classic versions up to 15.4.1 allows an attacker to read arbitrary files from the vict
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is achievable by tricking a vict
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 enables arbitrary code execution in t
Arbitrary code execution in Adobe Lightroom Classic versions up to and including 15.4.1 is triggered when a victim opens
Out-of-bounds write in Adobe Lightroom Classic allows arbitrary code execution under the context of the logged-in user w
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the security co
Out-of-bounds write in Adobe Lightroom Classic versions up to 15.4.1 enables arbitrary code execution in the context of
Out-of-bounds write in Adobe Lightroom Classic versions up to and including 15.4.1 allows arbitrary code execution in th
Lightroom Desktop versions 8.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arb
Arbitrary code execution in Adobe Lightroom Desktop 15.1 and earlier via an out-of-bounds write vulnerability when users
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today