CVE-2026-47940 is an integer overflow in Adobe Lightroom Classic's image dimension parsing that can lead to heap corruption and arbitrary code execution. The vulnerability triggers when Lightroom processes a specially crafted image file—RAW, DNG, or TIFF variants—with manipulated dimension values that overflow the integer arithmetic used to calculate buffer sizes. An attacker who tricks a user into opening a malicious file achieves code execution in the Lightroom process context.
Apply theAdobe patch immediately. Lightroom's auto-update mechanism is insufficient for security-critical updates—verify your installed version against the advisory and manually confirm the patch status. Until patched, avoid opening image files from untrusted sources, particularly RAW formats which are the likely attack vehicle given the vulnerability location in dimension parsing code.
The CVSS 7.8 score obscures two critical risk factors. First, Lightroom's user population—professional photographers and studios—routinely opens files from clients, stock libraries, and email attachments as core workflow. The 'user interaction required' element is not a meaningful barrier for this user base; it's the product's primary function. Second, Adobe products share parsing infrastructure across product lines. If Lightroom's RAW decoder uses shared Camera Raw components—as is architecturally likely—then Premiere Pro, After Effects, Bridge, and Media Encoder may all inherit the same vulnerable code path. A successful exploit propagates across whatever Adobe workflow touches that file.
Treat this as a higher priority than the EPSS score (0.00181) suggests. EPSS models historical exploitation patterns that underweight file-based attacks against creative software, where 'user interaction' has never been an effective barrier. The actual exploit likelihood for a weaponized variant targeting creative professionals is likely higher than the score indicates.
The vulnerability likely resides in legacy dimension-parsing code— TIFF handlers, deprecated RAW variant support, or other paths that haven't been actively maintained but remain compiled-in. This 'sediment layer' of unfuzzed legacy code is where this class of vulnerability consistently survives. After patching, audit your team's Adobe installation inventory across all creative applications, not just Lightroom, and consolidate to the smallest number of installations necessary to reduce your attack surface.