CVE-2026-48404

The CVSS-to-EPSS gap on CVE-2026-48404 isn't just an analytical curiosity — it's a diagnostic of how scoring frameworks fail to model attacker economics in prosumer software. A 7.8 HIGH severity rating with an EPSS of 0.00158 tells you that active exploitation is essentially nonexistent despite the technical outcome of arbitrary code execution. The disconnect is informative: EPSS, trained on observed exploitation patterns, is signaling that this vulnerability class in this product category faces real-world barriers that CVSS can't price. Those barriers are the social-engineering friction that doesn't show up in CVSS metrics. A malicious RAW or DNG file must be delivered to a Lightroom user — professional photographers, creative directors, agency staff who receive files from clients and open attachments as part of their work. These aren't random consumers; they're high-value targets whose compromised systems contain unreleased portfolios, client work, and potentially access to production content environments. The blast radius of compromise isn't arbitrary code execution in an app — it's access to valuable intellectual property and potential lateral movement into creative industry infrastructure. The vulnerability class persists precisely because mass-exploitation signatures don't capture targeted, surgical operations against high-value populations. For practitioners, the practical implication is this: prioritize architectural remediation over patch velocity. Parser sandboxing, isolate-by-default architecture for file format handlers, and narrowing the TCB for media parsers are the interventions that would actually change exploit economics. A fast patch closes the CVE and drops the score while leaving the structural condition intact — and the next parser bug in the same address space will produce the same HIGH rating with the same low EPSS. The lineage of file-based RCE in Adobe products spans decades not because fixes fail, but because the incentive structure rewards closing CVEs rather than changing the threat model. For Lightroom specifically, the deployment surface is fragmented — subscription auto-update users, enterprise lock-step release cycles, and hardware-locked workstations running deprecated plugin chains create different exposure half-lives that neither CVSS nor EPSS captures. A HIGH rating applied across an unpatched tail of orphaned installations is categorically different from the same rating in software with uniform update enforcement.

Reviewed through automated stages and approved by a human before publication.