CVE-2026-47940: Adobe Lightroom RCE Vulnerability

CVE-2026-47940 Overview

CVE-2026-47940 is an integer overflow vulnerability in Adobe Lightroom Classic that enables arbitrary code execution in the context of the current user. The flaw is classified under CWE-190: Integer Overflow or Wraparound. Exploitation requires user interaction: a victim must open a malicious file crafted by an attacker. Successful exploitation grants the attacker the same privileges as the user running Lightroom Classic, leading to high impacts on confidentiality, integrity, and availability. Adobe has published a security bulletin addressing this issue.

Critical Impact
Attackers can execute arbitrary code with the privileges of the logged-in user by convincing that user to open a maliciously crafted Lightroom Classic file.

Affected Products

Adobe Lightroom Classic (see Adobe Lightroom Security Advisory APSB26-94 for affected versions)
Microsoft Windows platforms running vulnerable Lightroom Classic installations
macOS platforms running vulnerable Lightroom Classic installations

Discovery Timeline

2026-08-11 - CVE-2026-47940 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-47940

Vulnerability Analysis

CVE-2026-47940 stems from an integer overflow or wraparound condition [CWE-190] within Adobe Lightroom Classic. The application performs arithmetic on integer values, most likely during parsing of image or metadata structures, without validating that the result fits within the destination integer type. When the computed value wraps around, subsequent memory allocation or indexing operations use a truncated or negative size. This mismatch between the computed size and the actual data written produces memory corruption that can be shaped into arbitrary code execution. Because Lightroom Classic runs at user privilege, the executed code inherits the identity and access rights of the current user, including local files, network shares, and any credentials cached in the user session.

Root Cause

The root cause is missing or insufficient bounds checking on an arithmetic operation involving attacker-controlled values embedded in a file. When Lightroom Classic parses the malicious file, an integer field influences a size or offset calculation. The calculation overflows the native integer width and wraps to a small or negative value, which the code then trusts as a valid buffer size or index.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious file, such as an image, catalog, preset, or other supported asset, and delivers it through phishing email, a compromised website, shared cloud storage, or removable media. Exploitation occurs when the victim opens the file in Adobe Lightroom Classic. No prior authentication to the target system is required beyond the victim's own session.

No verified public proof-of-concept code is available for this vulnerability. Technical parsing details are limited by Adobe's coordinated disclosure. Refer to the Adobe Lightroom Security Advisory APSB26-94 for vendor-supplied information.

Detection Methods for CVE-2026-47940

Indicators of Compromise

Unexpected child processes spawned by Lightroom.exe or the Lightroom Classic helper processes, particularly command interpreters such as cmd.exe, powershell.exe, or wscript.exe.
Lightroom Classic processes writing executable files, DLLs, or scripts to user-writable directories such as %APPDATA%, %TEMP%, or %LOCALAPPDATA%.
Lightroom Classic initiating outbound network connections to previously unseen external hosts shortly after opening a file.
Crash events or Windows Error Reporting entries referencing Lightroom Classic modules after opening image or catalog files from untrusted sources.

Detection Strategies

Deploy behavioral endpoint detection rules that flag image editing applications spawning shell, script, or LOLBin processes.
Alert on Lightroom Classic loading unsigned or unexpected DLLs from user-writable paths.
Correlate mail gateway or web proxy telemetry with subsequent file-open events in Lightroom Classic to identify delivery of malicious assets.

Monitoring Recommendations

Inventory endpoints running Adobe Lightroom Classic and confirm patch status against Adobe advisory APSB26-94.
Enable process creation logging (Windows Event ID 4688 or Sysmon Event ID 1) with command-line auditing on workstations used for creative work.
Monitor file integrity on Lightroom installation directories and user preset folders to identify tampering.

How to Mitigate CVE-2026-47940

Immediate Actions Required

Apply the security update referenced in Adobe Lightroom Security Advisory APSB26-94 to all installations of Lightroom Classic.
Instruct users to avoid opening Lightroom Classic files received from untrusted sources such as unsolicited email attachments or unknown websites.
Enforce least-privilege on endpoints so that Lightroom Classic does not run under administrative accounts.

Patch Information

Adobe has released fixed versions of Lightroom Classic addressing CVE-2026-47940. Refer to Adobe Security Bulletin APSB26-94 for the specific fixed builds and download locations. Administrators should deploy the update through Adobe Creative Cloud or their standard software distribution process.

Workarounds

Restrict Lightroom Classic use to files originating from trusted internal sources until patching is complete.
Use email gateway and web proxy policies to block or quarantine uncommon image and catalog file types from external senders.
Enable operating system exploit mitigations such as Data Execution Prevention (DEP) and Control Flow Guard for the Lightroom Classic process.

bash

# Verify installed Lightroom Classic version on Windows
reg query "HKLM\SOFTWARE\Adobe\Lightroom Classic" /s | findstr /i version

# Verify installed Lightroom Classic version on macOS
defaults read "/Applications/Adobe Lightroom Classic/Adobe Lightroom Classic.app/Contents/Info.plist" CFBundleShortVersionString