CVE-2026-48397: Adobe Lightroom RCE Vulnerability

CVE-2026-48397 Overview

Adobe Lightroom Classic contains a deserialization of untrusted data vulnerability [CWE-502] that enables arbitrary code execution in the context of the current user. An attacker crafts a malicious file that, when opened by the victim, triggers unsafe deserialization within the application. Successful exploitation runs attacker-controlled code with the privileges of the user running Lightroom Classic. The issue carries a changed scope, meaning impact can extend beyond the vulnerable component to other resources on the host. Exploitation requires user interaction: the victim must open the malicious file.

Critical Impact
Arbitrary code execution as the current user through a malicious file, with scope change extending impact beyond the Lightroom Classic process.

Affected Products

Adobe Lightroom Classic (see Adobe advisory APSB26-94 for affected versions)
Microsoft Windows platforms running Lightroom Classic
macOS installations of Lightroom Classic per vendor advisory

Discovery Timeline

2026-08-11 - CVE-2026-48397 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-48397

Vulnerability Analysis

The flaw is an insecure deserialization issue in Adobe Lightroom Classic. Lightroom deserializes data from a file supplied by the user without adequately validating or restricting the object types reconstructed during that process. An attacker crafts a file that, once parsed, instantiates objects or invokes methods that lead to code execution. Because the CVSS scope is changed, an exploit can affect resources beyond the Lightroom Classic security boundary, such as other user-accessible files, credentials in the user profile, or downstream services the user session can reach. The attack vector is local: the malicious file must be delivered to the victim through email, shared storage, cloud sync, or a website, and the victim must open it in Lightroom Classic.

Root Cause

The root cause is unsafe deserialization of untrusted input, classified as [CWE-502]. Lightroom Classic reconstructs serialized objects from a file format it accepts without enforcing a strict allowlist of expected classes, integrity checks on the serialized data, or sandboxing of the parser. This allows attacker-controlled gadgets present in the application or its libraries to execute during object reconstruction.

Attack Vector

Exploitation begins with the attacker distributing a malicious catalog, preset, profile, or image sidecar file crafted to exploit the deserializer. Delivery vectors include phishing attachments, malicious downloads, shared team catalogs, and cloud-synced folders. When a user opens the file in Lightroom Classic, the deserialization path runs and drops into attacker-controlled code paths. The process inherits the user's rights, so subsequent actions such as file access, persistence, or lateral movement occur under that user context.

No public proof-of-concept code is available for CVE-2026-48397 at the time of publication. Refer to the Adobe Security Bulletin APSB26-94 for vendor technical details.

Detection Methods for CVE-2026-48397

Indicators of Compromise

Lightroom Classic (Lightroom.exe on Windows, Adobe Lightroom Classic on macOS) spawning shells, script interpreters, or LOLBins such as powershell.exe, cmd.exe, wscript.exe, or osascript.
Unexpected outbound network connections from the Lightroom process shortly after a file open event.
New persistence entries (Run keys, scheduled tasks, LaunchAgents) created by the Lightroom process or its children.
Catalog, preset, or profile files (.lrcat, .lrtemplate, .xmp) received from untrusted sources and opened immediately before suspicious activity.

Detection Strategies

Alert on process-tree anomalies where Lightroom Classic is the parent of interpreters, rundll32, or regsvr32.
Monitor for file writes by Lightroom into autostart, startup folder, or user profile script locations.
Correlate opening of externally sourced catalog and preset files with process creation and network telemetry from the same session.

Monitoring Recommendations

Ingest endpoint process and file telemetry from workstations running Lightroom Classic into a central analytics platform.
Baseline normal Lightroom child-process behavior so deviations trigger investigation.
Track email and file-sharing platforms for .lrcat, .lrtemplate, .xmp, and archive files delivered to creative or marketing teams.

How to Mitigate CVE-2026-48397

Immediate Actions Required

Apply the Lightroom Classic update referenced in Adobe Security Bulletin APSB26-94 to all affected endpoints.
Inventory workstations running Lightroom Classic and prioritize systems used by users who routinely open externally sourced files.
Instruct users not to open Lightroom catalog, preset, or profile files received from untrusted senders until patching is complete.

Patch Information

Adobe published fixed versions in advisory APSB26-94. Deploy the vendor-supplied installer through your standard software distribution channel and confirm the updated build number on each endpoint. Details are available in the Adobe Security Bulletin APSB26-94.

Workarounds

Block delivery of Lightroom catalog and template files (.lrcat, .lrtemplate) from external senders at the mail gateway until patches are deployed.
Restrict Lightroom Classic execution to standard user accounts, not administrative accounts, to limit the impact of code execution.
Enforce application allowlisting rules that prevent Lightroom from launching command interpreters or scripting engines.

bash

# Example: block Lightroom from spawning script hosts via Windows AppLocker publisher rule
New-AppLockerPolicy -RuleType Deny -User Everyone `
  -FilePath "C:\Windows\System32\wscript.exe" `
  -Description "Deny wscript when parent is Lightroom.exe"