CVE-2026-48447: Adobe Lightroom Auth Bypass Vulnerability

CVE-2026-48447 Overview

CVE-2026-48447 is an Incorrect Authorization vulnerability [CWE-863] affecting Adobe Lightroom Classic on Microsoft Windows. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. The issue has a changed scope, meaning impact extends beyond the vulnerable component's original security boundary. Adobe published guidance in Security Advisory APSB26-94. The vulnerability carries a CVSS 3.1 score of 7.7 and is classified as local because the attack vector requires the victim to process a malicious file on the affected host.

Critical Impact
Attackers can achieve arbitrary code execution under the current user's privileges after a victim opens a crafted Lightroom Classic file.

Affected Products

Adobe Lightroom Classic (see Adobe advisory APSB26-94 for versions)
Microsoft Windows
Systems where users open untrusted Lightroom project or catalog files

Discovery Timeline

2026-08-11 - CVE-2026-48447 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-48447

Vulnerability Analysis

The vulnerability stems from an authorization check that does not correctly validate whether an actor is permitted to perform a privileged action inside Lightroom Classic. When the application processes a specially crafted file, the flawed authorization logic allows operations that should have been blocked. This leads to arbitrary code execution in the context of the user running Lightroom Classic. The advisory notes that exploitation depends on conditions beyond the attacker's control, indicating the flaw is not deterministic on every attempt. The scope change reflected in the CVSS vector means code execution can affect resources managed by a security authority different from the vulnerable component.

Root Cause

The underlying weakness is classified as CWE-863: Incorrect Authorization. Lightroom Classic performs an authorization decision that either uses incorrect logic, checks an incorrect subject or object, or fails to enforce the outcome consistently. As a result, actions that should be denied to a malicious input path are permitted, exposing memory or execution flow to attacker-controlled data.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious Lightroom Classic file, such as a catalog, preset, or image container, through phishing, a shared drive, or a download link. When the victim opens the file with Lightroom Classic on Windows, the flawed authorization path is triggered and attacker-supplied logic executes with the user's rights. No prior privileges on the host are required, but successful exploitation is gated by user action and by conditions the attacker cannot fully control. No public proof-of-concept or in-the-wild exploitation has been reported at the time of NVD publication.

No verified code examples are available. Refer to the Adobe Security Advisory APSB26-94 for vendor technical details.

Detection Methods for CVE-2026-48447

Indicators of Compromise

Lightroom Classic (Lightroom.exe) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or rundll32.exe.
Newly created executables, DLLs, or scripts in %APPDATA%, %LOCALAPPDATA%, or user Documents directories immediately after a Lightroom session.
Outbound network connections initiated by Lightroom.exe to previously unseen hosts.
Untrusted Lightroom catalog (.lrcat), preset, or plugin files arriving via email, chat, or file-sharing platforms.

Detection Strategies

Build EDR rules that flag child process creation from Lightroom.exe where the child is a shell, script host, or LOLBin.
Monitor for module loads from user-writable paths inside the Lightroom process to catch DLL sideloading or plugin abuse.
Correlate file-open telemetry with subsequent process, file, and network events to reveal exploitation chains starting from a document open.

Monitoring Recommendations

Ingest Windows Sysmon or equivalent process, image load, and file create events for hosts running Lightroom Classic.
Alert on Lightroom writing to autostart locations such as Run keys, Startup folder, or Scheduled Tasks.
Track email and web gateway logs for Lightroom-associated file extensions delivered from external senders.

How to Mitigate CVE-2026-48447

Immediate Actions Required

Apply the fixed Lightroom Classic version listed in Adobe Security Advisory APSB26-94 as soon as testing allows.
Inventory Windows endpoints running Lightroom Classic and prioritize creative and design workstations for patching.
Instruct users to avoid opening Lightroom catalogs, presets, or plugins received from untrusted sources.

Patch Information

Adobe has released updated Lightroom Classic builds that remediate CVE-2026-48447. Version details and download links are provided in Adobe Security Advisory APSB26-94. Deploy the update through Adobe Creative Cloud or your managed software distribution platform, and verify installed versions with an endpoint software inventory query.

Workarounds

Block delivery of Lightroom project, catalog, and plugin files from external senders at the email gateway until patching is complete.
Run Lightroom Classic under standard user accounts, never with administrative privileges, to limit the impact of code execution.
Enable application control or Windows Defender Application Control policies that restrict script interpreters from launching as children of Lightroom.

bash

# Query installed Lightroom Classic version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Lightroom Classic*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation