Executive brief
Adobe Lightroom Classic, a popular photo editing and management application, contains an out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code on a user's system. An attacker would need to trick a victim into opening a specially crafted malicious file, after which code would run with the privileges of the current user.
Technical details
This vulnerability is a memory safety issue (out-of-bounds write) in Adobe Lightroom Classic's file parsing logic. The root cause lies in inadequate bounds checking when processing certain file formats, allowing an attacker to write data beyond allocated memory boundaries. The attack vector is user interaction: a victim must open a malicious file (e.g., a crafted image or catalog file) to trigger the vulnerability. No authentication or special privileges are required. Successful exploitation results in arbitrary code execution in the context of the current user. Patches are expected to be available through Adobe's regular security update process.
Affected products
- Adobe Lightroom Classic
Timeline
- 2026-08-11: disclosed