The vulnerability is an Incorrect Authorization flaw identified as CWE‑863 that allows an attacker to execute arbitrary code in the context of the user running Lightroom Classic. The flaw alters the privilege scope, enabling unauthorized actions when a malicious file is processed. The impact is that the code runs with the victim’s user rights, which could lead to system compromise or data leakage.

Adobe Lightroom Classic is affected. No specific version range is disclosed in the announcement, so all installations of Lightroom Classic are potentially vulnerable until a patch is released.

The CVSS score of 7.7 indicates a high severity issue, though the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the victim to open a crafted file, and the description notes that additional conditions beyond the attacker’s control are necessary, suggesting that the practical exploitation window may be limited. Nevertheless, the scope change raises the risk, especially in environments where users commonly open unknown files. Monitoring and prompt patching are therefore advised.