CVE-2026-48408 is an out-of-bounds write vulnerability in Adobe Lightroom Classic's image format parsing, scoring 7.8 CVSS but carrying an EPSS of only 0.00158. That gap is the story — and it should change how you think about patching creative software.
The CVSS captures worst-case technical severity: arbitrary code execution via malformed media files. The low EPSS reflects that, today, exploiting this requires a user to open a malicious .xmp, .dng, or TIFF file. But the "user interaction" safeguard that EPSS prices in is eroding faster than the metric accounts for. Lightroom isn't an email attachment workflow — it's a creative tool where users routinely ingest files from stock libraries, client uploads, camera cards, and collaborative albums. Opening a suspicious-looking photo feels categorically different from running an executable, which means the mental friction that historically made "user interaction" CVSS modifiers meaningful has already weakened for this software class.
More concerning is the supply chain angle. The attack surface isn't just "someone emails you a bad photo." Compromised cameras, poisoned stock library uploads, or weaponized presets can produce files that look completely legitimate when they hit Lightroom's parser. The vulnerability lives in the DNG, XMP, and TIFF metadata handlers — code paths that see less fuzzing investment than browser renderers precisely because they're viewed as stable legacy parsers. Adobe's "Classic" product line receives diminishing security attention compared to CC versions, meaning the technical debt in these format handlers accumulates faster than it gets addressed.
The historical pattern is instructive: CVE-2019-7814, CVE-2019-7957, and CVE-2021-21071 followed the same trajectory — high CVSS, low initial EPSS, then exploitation techniques emerged 12-18 months later and the population of unpatched systems became suddenly dangerous. The EPSS of 0.00158 isn't a stable signal of safety; it's a lagging indicator that will age poorly as exploit research matures.
Prioritize patching Lightroom Classic for any machine with access to Creative Cloud asset libraries, client deliverables, or CMS publishing pipelines. The blast radius of a successful exploit extends beyond the photographer's workstation to systems with authenticated access to your entire media supply chain. Set up monitoring for PoC emergence on this vulnerability class — when a reliable exploit technique publishes, the window between that and patch adoption is when exposure becomes real. If your organization runs creative teams, elevate image processing software in your asset prioritization model: the user interaction friction that once justified lower patching urgency no longer holds for workflows where file ingestion is routine and low-suspicion.