CVE-2024-20754: Adobe Lightroom RCE Vulnerability

CVE-2024-20754 Overview

CVE-2024-20754 is an untrusted search path vulnerability affecting Adobe Lightroom Desktop versions 7.1.2 and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published the issue in security bulletin APSB24-17. The vulnerability maps to CWE-426: Untrusted Search Path and requires local access with user interaction. Successful exploitation grants attackers the ability to execute code with the privileges of the logged-in user, compromising confidentiality, integrity, and availability of the affected system.

Critical Impact
An attacker who convinces a user to open a crafted file can achieve arbitrary code execution under the current user's privileges on systems running Adobe Lightroom 7.1.2 or earlier.

Affected Products

Adobe Lightroom Desktop versions 7.1.2 and earlier
Apple macOS (as an affected platform per NVD CPE data)
Any workstation with vulnerable Lightroom installations used for photo editing workflows

Discovery Timeline

2024-03-18 - CVE-2024-20754 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-20754

Vulnerability Analysis

The vulnerability stems from Adobe Lightroom's reliance on an untrusted search path when locating critical resources such as libraries or executable components. When the application resolves these resources at runtime, it does not sufficiently constrain the directories it searches. An attacker who plants a malicious file in a directory that appears earlier in the search order can cause Lightroom to load attacker-controlled code. Execution occurs in the context of the invoking user, so any files, credentials, or network resources accessible to that user become reachable to the attacker's payload.

Root Cause

The root cause is improper control of the search path used to locate program dependencies, classified under CWE-426. Lightroom does not enforce absolute paths or a hardened, validated search order for resolving resources. This weakness lets attacker-writable directories take precedence over trusted system locations during dependency resolution.

Attack Vector

Exploitation requires local access and user interaction. The victim must open a malicious file crafted to trigger Lightroom's dependency-loading logic. The attacker stages a malicious binary or library along a directory the application searches before authoritative system paths. When Lightroom loads the resource, the malicious code executes with the user's privileges. Common delivery channels include phishing emails carrying compressed archives, shared network drives, and removable media that place both the lure file and the malicious dependency into the same folder. Refer to the Adobe Lightroom Security Advisory (APSB24-17) for vendor guidance.

Detection Methods for CVE-2024-20754

Indicators of Compromise

Unexpected DLL, dylib, or executable files placed in directories alongside Lightroom project files, presets, or catalog folders
Lightroom parent processes (Lightroom.exe, Adobe Lightroom) spawning shells, script interpreters, or LOLBins such as powershell.exe, cmd.exe, osascript, or bash
Outbound network connections from Lightroom to non-Adobe infrastructure shortly after opening a shared file
Creation of persistence artifacts (scheduled tasks, LaunchAgents, registry Run keys) with Lightroom as the parent process

Detection Strategies

Hunt for Lightroom loading modules from user-writable paths such as Downloads, Desktop, temporary directories, or network shares instead of standard install locations
Alert on unsigned or newly written binaries loaded by Lightroom, correlating file creation events with subsequent image loads
Correlate file-open telemetry with process creation to identify suspicious child processes originating from Lightroom

Monitoring Recommendations

Enable module-load and image-load telemetry on endpoints running creative software and forward it to a centralized data lake for hunting
Monitor %APPDATA%, %TEMP%, ~/Library/Application Support/, and shared project directories for new executable content adjacent to Lightroom assets
Track Lightroom version inventory across the fleet to identify hosts still running 7.1.2 or earlier

How to Mitigate CVE-2024-20754

Immediate Actions Required

Update Adobe Lightroom Desktop to the fixed release identified in Adobe security bulletin APSB24-17
Instruct users not to open Lightroom catalog files, presets, or project archives received from untrusted sources
Restrict write permissions on directories where Lightroom resolves resources to prevent adversary-controlled files from taking precedence
Inventory endpoints running vulnerable versions and prioritize patch deployment for creative and media workstations

Patch Information

Adobe released fixed versions of Lightroom Desktop that address the untrusted search path condition. Administrators should consult the Adobe Lightroom Security Advisory (APSB24-17) for the exact fixed version numbers and download locations, then deploy the update through Creative Cloud or managed software distribution tools.

Workarounds

Open Lightroom project files only from trusted, read-only locations controlled by the organization
Apply application allowlisting to block execution of unsigned binaries loaded by Lightroom
Enforce least-privilege user accounts so that successful exploitation does not yield administrative rights
Disable auto-opening of files from removable media and quarantine attachments delivered via email

bash

# Example: verify installed Lightroom version on macOS before allowing use
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe Lightroom/Adobe Lightroom.app"

# Example: restrict write access to a shared Lightroom assets directory (Linux/macOS)
chmod -R a-w /srv/creative/lightroom-assets
chown -R root:creative /srv/creative/lightroom-assets