[NEW] [high] Adobe Creative Cloud (Lightroom Classic): Multiple vulnerabilities enable Code Execution

CSIRTS triage

What

Multiple code execution vulnerabilities exist in Adobe Lightroom Classic.

Who is affected

Users running Adobe Lightroom Classic with any of the affected versions.

Urgency

High severity due to arbitrary code execution capability; apply updates promptly.

Action

Update Adobe Lightroom Classic to the patched version provided by Adobe.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-12

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2773

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-479400.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-483970.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484040.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484050.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484060.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484070.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484080.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484090.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484100.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-484410.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• highCVE-2026-48447: Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in…nvd
• highCVE-2026-48441: Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Director…nvd
• highCVE-2026-48410: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48409: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48408: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48407: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48406: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48405: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48404: Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arb…nvd
• highCVE-2026-48397: Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could …nvd
• highCVE-2026-47940: Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could re…nvd

Recent advisories for Adobe Creative Cloud

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• medium[UPDATE] [medium] Adobe Creative Cloud applications: Multiple vulnerabilitiescert-bund · 2026-08-03
• high[NEW] [high] Adobe Creative Cloud (Bridge and Format Plugins): Multiple vulnerabilitiescert-bund · 2026-07-29
• high[NEW] [high] Adobe Creative Cloud Applications: Multiple vulnerabilitiescert-bund · 2026-07-15

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25