SB20260814110 - Multiple vulnerabilities in Lightroom
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Path traversal (CVE-ID: CVE-2026-48441)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to path traversal in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2026-48397)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to deserialization of untrusted data in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
3) Integer overflow (CVE-ID: CVE-2026-47940)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to integer overflow or wraparound in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
4) Out-of-bounds write (CVE-ID: CVE-2026-48404)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
5) Out-of-bounds write (CVE-ID: CVE-2026-48405)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
6) Out-of-bounds write (CVE-ID: CVE-2026-48406)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
7) Out-of-bounds write (CVE-ID: CVE-2026-48407)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
8) Out-of-bounds write (CVE-ID: CVE-2026-48408)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
9) Out-of-bounds write (CVE-ID: CVE-2026-48409)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
10) Out-of-bounds write (CVE-ID: CVE-2026-48410)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to out-of-bounds write in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
11) Incorrect authorization (CVE-ID: CVE-2026-48447)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to incorrect authorization in Adobe Lightroom when opening a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to open a crafted file.
Remediation
Install update from vendor's website.