Adobe Security Bulletin

Last updated on Aug 11, 2026

Security Update Available for Adobe Lightroom Classic | APSB26-94

Bulletin ID

Date published

Priority

ASPB26-94

August 11, 2026

3

style

grid width 12

Summary

Adobe has released a security update for Adobe Lightroom Classic. This update addresses critical vulnerabilities that could result in arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this updates.

Affected Versions

Product

Version

Platform

Lightroom Classic

15.4 and earlier

Windows

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app’s update mechanism. For more information, please reference this help page.

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

Product

Version

Platform

Priority rating

Availability

Lightroom Classic

15.5

All

3

Download Center

style

grid width 12

Vulnerability Details

CVE-2026-48441

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-48397

Vulnerability category: Deserialization of Untrusted Data (CWE-502)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-47940

Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48404

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48405

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48406

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48407

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48408

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48409

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48410

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48447

Vulnerability category: Incorrect Authorization (CWE-863)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.7
CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Note

Effective August 11, 2026, Adobe may assign a single CVE identifier to internally discovered vulnerabilities with the same severity rating and CWE category when a release includes systemic fixes.

style

xl spacing, one up, grid width 12, static-links, xxl-spacing-top

Acknowledgments

Adobe would like to thank the following for reporting the relevant issues and for working with Adobe to help protect our customers:

Kieran (kaiksi) — CVE-2026-48441, CVE-2026-48397, CVE-2026-48447
yjdfy — CVE-2026-48404, CVE-2026-48405, CVE-2026-48406, CVE-2026-48407, CVE-2026-48408, CVE-2026-48409, CVE-2026-48410, CVE-2026-47940

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

CardTitle

APSB26-94

CardDescription

Priority 3 Security update

CardImage

Adobe

Created

2026-08-11

Tags

caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/lightroom

PrimaryTag

caas:content-type/article

Details

caas:mnemonics/lightroom

Arbitrary

search: CVE-2026-48441 CVE-2026-48397 CVE-2026-47940 CVE-2026-48404 CVE-2026-48405 CVE-2026-48406 CVE-2026-48407 CVE-2026-48408 CVE-2026-48409 CVE-2026-48410 CVE-2026-48447