Adobe Lightroom Classic Deserialization Vulnerability Allows Arbitrary Code Exec
CVE-2026-48397 Published on August 11, 2026

Lightroom Classic | Deserialization of Untrusted Data (CWE-502)
Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-48397 can be exploited with local system access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a Marshaling, Unmarshaling Vulnerability?

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

CVE-2026-48397 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.


Products Associated with CVE-2026-48397

Want to know whenever a new CVE is published for Adobe Lightroom? stack.watch will email you.

Adobe Lightroom
 

Affected Versions

Adobe Lightroom Classic: