Adobe Lightroom vulnerabilities

19 CVEs affecting Adobe Lightroom, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-48447, published 2026-08-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-9724, published 2020-08-19. High severity, CVSS 7.8. EPSS: 2.7% chance of exploitation in the next 30 days. Adobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2026-48397, published 2026-08-11. High severity, CVSS 8.6. EPSS: 1% chance of exploitation in the next 30 days. Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this…
CVE-2020-24447, published 2020-12-11. High severity, CVSS 7.0. EPSS: 0.8% chance of exploitation in the next 30 days. Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current…
CVE-2021-40776, published 2022-06-15. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Adobe Lightroom Classic 10.3 (and earlier) are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability…
CVE-2021-43753, published 2023-09-07. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Adobe Lightroom versions 4.4 (and earlier) are affected by a use-after-free vulnerability in the processing of parsing TIF files that could result in privilege escalation. Exploitation of this issue…
CVE-2024-20754, published 2024-03-18. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the…
CVE-2026-47940, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires…
CVE-2026-48441, published 2026-08-11. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could…
CVE-2026-48410, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48409, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…

Latest

CVE-2026-48447, published 2026-08-11. High severity, CVSS 7.7. EPSS: 0.2% chance of exploitation in the next 30 days. Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this…
CVE-2026-48408, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48407, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48406, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48405, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48404, published 2026-08-11. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…