CVE-2026-21349
Published: 10 February 2026
Summary
CVE-2026-21349 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Lightroom. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, and patching of the out-of-bounds write flaw in Lightroom Desktop as specified in Adobe Security Bulletin APSB26-06.
Enables vulnerability scanning to identify deployed instances of vulnerable Lightroom Desktop versions affected by CVE-2026-21349.
Ensures receipt and distribution of security advisories like APSB26-06 to prompt remediation of the Lightroom vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB write enables arbitrary code exec via malicious file opened by user (T1204.002); directly matches client app exploitation (T1203).
NVD Description
Lightroom Desktop versions 15.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
Deeper analysisAI
CVE-2026-21349 is an out-of-bounds write vulnerability (CWE-787) in Adobe Lightroom Desktop versions 15.1 and earlier. The flaw occurs during file processing and can result in arbitrary code execution in the context of the current user.
Exploitation requires local access and user interaction, as a victim must open a malicious file. An attacker can craft such a file to trick the user, leading to code execution with the privileges of the logged-in user. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact on confidentiality, integrity, and availability with low attack complexity.
Adobe Security Bulletin APSB26-06 provides details on the vulnerability and available patches. Practitioners should consult https://helpx.adobe.com/security/products/lightroom/apsb26-06.html for mitigation steps, including updating to a patched version of Lightroom Desktop.
Details
- CWE(s)