CVE-2026-48406

The CVSS 7.8 on CVE-2026-48406 will drive emergency patching responses, but the EPSS of 0.00158 is telling you something important: exploitation probability sits in the bottom quartile. Don't ignore that signal — interrogate it. This is an out-of-bounds write in Lightroom's DNG/RAW/PSD parser. The vulnerability is real and technically severe — arbitrary code execution is possible. But the user-interaction requirement creates a meaningful exploitation friction that the CVSS formula treats as a simple checkbox but which, for Lightroom's professional user base, represents a genuinely different threat model. Photographers routinely receive files from clients, studios, and third-party contributors. The attack surface isn't 'user opens sketchy attachment' — it's 'creative professional receives a compromised file through a trusted workflow.' That's a supply chain problem that patching Lightroom alone doesn't solve. Here's what should drive your prioritization decision: the historical record for this vulnerability class — arbitrary code execution via file parser, user interaction required — shows bimodal outcomes. Most sit dormant. But a meaningful subset get exploited, and they tend to do so precisely through the supply chain delivery mechanism that makes Lightroom users attractive targets. The EPSS reflects current conditions: tooling cost, social engineering friction, targeted delivery requirements. Those conditions are not stable. AI-assisted exploit generation is compressing the tooling barrier, and proof-of-concept accumulation is steadily eroding the exploitation floor. My recommendation: apply this patch within your standard 7-14 day cycle rather than emergency-level response, but treat it as a higher-priority queue item than a typical 7.8 CVE. The low EPSS justifies skipping emergency patching economics, but the blast radius matters — Lightroom users run the full Adobe suite, and successful code execution pivots into contexts with access to brand assets, unreleased content, and production infrastructure credentials. The gap between CVSS and EPSS is real, but it signals 'not mass-exploited yet' rather than 'safe to defer.' Monitor EPSS trajectory over the next 30 days. A spike triggers accelerated remediation. The window between disclosure and patch application is where bimodal exploitation historically materializes for this class — keep that exposure window tight.

Reviewed through automated stages and approved by a human before publication.