## Summary
Adobe Lightroom Classic contains an out-of-bounds write vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file.
## Technical Details
- Vulnerability type: out-of-bounds write
- Potential consequence: memory corruption leading to code execution
- CWE: CWE-787
- Attack vector: LOCAL
- User interaction requirement: victim must open a malicious file (UI:R)
## Affected
- Product: Adobe Lightroom Classic
## Impact
- Arbitrary code execution under the current user context
- Potential impacts include confidentiality, integrity, and availability compromise (as reflected by the provided CVSS metrics)
## Mitigation
1. Patch immediately with the vendor’s security update for Lightroom Classic (exact fixed versions not provided in the available data).
2. Reduce exposure by avoiding opening files from untrusted sources (since exploitation requires opening a malicious file).
3. Apply least-privilege practices so the current user context has minimal access to sensitive data.
4. Monitor for suspicious Lightroom Classic activity following file opens (e.g., unexpected child processes), noting that specific detection indicators were not available from references.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-787