CVE-2026-48406: Adobe Lightroom Classic RCE Vulnerability

CVE-2026-48406 Overview

CVE-2026-48406 is an out-of-bounds write vulnerability [CWE-787] in Adobe Lightroom Classic. Successful exploitation lets attackers execute arbitrary code in the context of the current user. The flaw requires user interaction: a victim must open a malicious file crafted by the attacker.

Adobe published the issue on 2026-08-11 in security bulletin APSB26-94. The vulnerability carries a CVSS 3.1 base score of 7.8 and affects Adobe Lightroom Classic on Microsoft Windows. No public exploit code, proof-of-concept, or in-the-wild exploitation has been reported at the time of publication.

Critical Impact

Attackers who convince a user to open a crafted image or catalog file can achieve arbitrary code execution with the privileges of the logged-in user, enabling malware deployment, credential theft, and lateral movement.

Affected Products

• Adobe Lightroom Classic (see Adobe advisory APSB26-94 for specific versions)
• Microsoft Windows platforms running affected Lightroom Classic builds
• Any workstation where users process untrusted image files with Lightroom Classic

Discovery Timeline

• 2026-08-11 - CVE-2026-48406 published to NVD and disclosed via Adobe security bulletin APSB26-94
• 2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-48406

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Adobe Lightroom Classic. Out-of-bounds writes occur when software writes data past the end, or before the beginning, of an allocated buffer. This corrupts adjacent memory structures such as heap metadata, function pointers, or virtual method tables.

An attacker who controls the out-of-bounds write can steer execution into attacker-supplied shellcode or reuse existing code gadgets. Because the flaw triggers during file parsing, the attack surface includes any format Lightroom Classic decodes, such as raw camera formats, TIFF, DNG, or catalog files.

The issue is local and user-assisted. The victim must open a malicious file, but the resulting code runs with the current user's privileges. On workstations where users hold administrative rights, the impact extends across the host.

Root Cause

Out-of-bounds writes in image processing software typically stem from insufficient validation of size or offset fields inside file headers. The parser trusts attacker-controlled length values and writes decoded pixel or metadata content beyond the destination buffer. Adobe's advisory APSB26-94 is the authoritative source for the affected component and fix details.

Attack Vector

The attack vector is local with required user interaction. Delivery paths include phishing emails carrying malicious image attachments, watering-hole downloads, and compromised shared photo libraries. Once the user opens the file in Lightroom Classic, the parser processes the malformed structure and the write primitive triggers, leading to code execution in the user's session.

No synthetic proof-of-concept is published here. Refer to the Adobe Security Advisory APSB26-94 for vendor-supplied technical context.

Detection Methods for CVE-2026-48406

Indicators of Compromise

• Lightroom Classic (Lightroom.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
• Crash events or Windows Error Reporting entries referencing Lightroom Classic modules during image import
• Outbound network connections initiated by Lightroom.exe to previously unseen or non-Adobe domains
• Unexpected file writes by Lightroom.exe to %APPDATA%, %TEMP%, or startup locations

Detection Strategies

• Hunt for process-lineage anomalies where Lightroom Classic parents scripting or shell interpreters
• Alert on module loads from user-writable paths within the Lightroom Classic process
• Correlate Lightroom Classic crashes with subsequent process creation or persistence events on the same host
• Inspect email and web gateway logs for delivery of raw image formats (.dng, .tif, .nef, .cr2) from untrusted senders

Monitoring Recommendations

• Enable Microsoft Defender Attack Surface Reduction rules that block child-process creation from Office and media applications, then extend equivalent behavioral policies to Lightroom Classic
• Forward Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) for Lightroom Classic to your SIEM
• Track Lightroom Classic version inventory to confirm systems remain on patched builds after remediation

How to Mitigate CVE-2026-48406

Immediate Actions Required

• Apply the patch documented in Adobe security bulletin APSB26-94 to all Windows endpoints running Lightroom Classic
• Inventory installations using software asset management or endpoint tooling to confirm patch coverage
• Warn users against opening image files or Lightroom catalogs received from untrusted sources until patching completes
• Ensure Windows accounts used for creative work operate without local administrator privileges to limit blast radius

Patch Information

Adobe released a fixed version of Lightroom Classic in bulletin APSB26-94. Consult the Adobe Security Advisory APSB26-94 for the exact fixed build numbers and download links. Deploy the update through Adobe Creative Cloud or your standard software distribution channel.

Workarounds

• Restrict Lightroom Classic to processing files from trusted, internally managed repositories until the patch is deployed
• Apply application-control policies that block execution of child processes and script interpreters from Lightroom.exe
• Route inbound image attachments through sandboxed detonation before delivery to end users

# Verify installed Lightroom Classic version on Windows endpoints
powershell -Command "Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*Lightroom Classic*' } | Select-Object DisplayName, DisplayVersion, Publisher"