Adobe Lightroom Classic < 15.5 Multiple Arbitrary code execution (APSB26-94)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339065);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/24");

  script_cve_id(
    "CVE-2026-47940",
    "CVE-2026-48397",
    "CVE-2026-48404",
    "CVE-2026-48405",
    "CVE-2026-48406",
    "CVE-2026-48407",
    "CVE-2026-48408",
    "CVE-2026-48409",
    "CVE-2026-48410",
    "CVE-2026-48441",
    "CVE-2026-48447"
  );

  script_name(english:"Adobe Lightroom Classic < 15.5 Multiple Arbitrary code execution (APSB26-94)");

  script_set_attribute(attribute:"synopsis", value:
"The Adobe Lightroom Classic instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Adobe Lightroom Classic installed on the remote Windows host is prior to 15.5. It is, therefore, affected
by multiple vulnerabilities as referenced in the APSB26-94 advisory.

  - Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path
    Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this
    vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of
    this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
    (CVE-2026-48441)

  - Lightroom Classic is affected by a Deserialization of Untrusted Data vulnerability that could result in
    arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability
    to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open
    a malicious file. Scope is changed. (CVE-2026-48397)

  - Lightroom Classic is affected by an Integer Overflow or Wraparound vulnerability that could result in
    arbitrary code execution in the context of the current user. Exploitation of this issue requires user
    interaction in that a victim must open a malicious file. (CVE-2026-47940)

  - Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code
    execution in the context of the current user. Exploitation of this issue requires user interaction in that
    a victim must open a malicious file. (CVE-2026-48404, CVE-2026-48405, CVE-2026-48406, CVE-2026-48407,
    CVE-2026-48408, CVE-2026-48409, CVE-2026-48410)

  - Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary
    code execution in the context of the current user. An attacker could exploit this vulnerability to execute
    arbitrary code. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue
    requires user interaction in that a victim must open a malicious file. Scope is changed. (CVE-2026-48447)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://helpx.adobe.com/security/products/lightroom/apsb26-94.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Adobe Lightroom Classic version 15.5 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48441");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(190, 22, 502, 787, 863);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/24");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:lightroom");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("adobe_lightroom_classic_installed.nbin");
  script_require_keys("installed_sw/Adobe Lightroom Classic", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'Adobe Lightroom Classic', win_local:TRUE);

var constraints = [
  { 'fixed_version' : '15.5' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);