Description

Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-11T18:17:29.427Z",
  "pubdate": "2026-08-11T18:17:29.427Z",
  "executiveSummary": "Adobe Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability, which exposes the system to severe security risks.\nThe primary impact of this vulnerability is arbitrary code execution, occurring directly within the security context of the currently logged-in user.\nThe affected product is Lightroom Classic.\nThe risk implications are critical, as successful exploitation could allow an adversary to execute arbitrary commands, compromise user data, or leverage the compromised user context for further system penetration.\nAttacker capabilities involve the ability to construct and deliver a malicious file engineered to leverage the insecure deserialization flaw within the application.\nExploitation requirements strictly necessitate user interaction; specifically, a targeted victim must actively open the maliciously crafted file utilizing the vulnerable software for the payload to trigger.",
  "technicalDetails": "The root cause of the vulnerability stems from the insecure handling and deserialization of untrusted data streams within Lightroom Classic.\nWhen the application processes a maliciously crafted file, the underlying deserialization mechanism improperly validates serialized objects before reconstructing them in memory.\nThis flaw allows an attacker to manipulate the serialized data structures to inject malicious objects, leading to memory corruption or the execution of arbitrary code during the object instantiation and processing phase.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious file containing serialized data designed to exploit the deserialization weakness. Second, the attacker delivers this file to the target victim via social engineering, external storage, or other delivery vectors. Third, the victim opens the malicious file using Lightroom Classic. Fourth, upon opening, the application parses and deserializes the untrusted data contained within the file without adequate verification. Finally, the malicious payload executes, achieving arbitrary code execution within the execution context of the current user.\nThe vulnerable component resides in the file parsing and data deserialization routines of Lightroom Classic.\nRegarding authentication and privilege requirements, the attack does not require prior authentication to the application, but it does execute under the standard privilege level of the currently active local user operating the software.\nThe network exposure for this specific attack vector is local, as it requires the local execution and opening of a file, though it can be triggered remotely if the file is downloaded and opened from untrusted sources via web or email.\nThe post-exploitation impact includes full code execution capabilities limited only by the privileges of the compromised user, potentially facilitating data exfiltration, installation of secondary malware, or lateral movement within the host environment."
}