CVE-2026-48447

The EPSS-CVS divergence in CVE-2026-48447 is analytically significant and deserves deeper scrutiny than the raw scores imply. The 7.7 CVSS combined with an EPSS of only 0.00144 is unusual: actively exploited vulnerabilities typically land in the 0.1-0.5 EPSS range. Low EPSS usually signals that automated systems haven't observed exploitation patterns, but this reading could be dangerously wrong for this vulnerability class. This is classified as an Incorrect Authorization flaw — not a heap overflow or use-after-free. Authorization failures in creative software are fundamentally different from memory corruption bugs. They emerge from workflow failures rather than parsing complexity: developers either didn't realize an authorization check was needed at a specific processing stage, implemented one that doesn't cover all code paths, or added a check that was later refactored into a bypass. The "conditions beyond the attacker's control" language in the CVE reinforces this — it signals a narrow code path dependency requiring very specific file configurations or processing states to trigger, exactly the kind of incomplete coverage that emerges under deadline pressure. The Scope: Changed classification is critical here. When Lightroom's file processing escapes its sandbox through an authorization failure rather than memory corruption, the blast radius extends beyond arbitrary code execution — it executes in the credential and trust context of a Lightroom user, potentially someone with access to ad platform APIs, stock photo accounts, or client deliverables. The implicit contract that "Lightroom files are safe to pass downstream" gets invalidated retroactively. There's a deeper problem with the EPSS score. The model's observation layer is trained predominantly on memory corruption vulnerabilities — bugs where exploitation leaves detectable artifacts (shellcode patterns, ROP chains, beacon signatures). Authorization flaws operate under a different paradigm: they require specific workflow knowledge and proprietary format handling expertise, and they don't produce the exploitation artifacts that automated systems observe. An EPSS this low might not mean "this is hard to exploit" — it might mean "our detection infrastructure wasn't designed to see this class of attack at all." For defenders, the key questions are: what Lightroom version introduced the vulnerable code path, and does the exploitation chain require chaining with another defect, or does the authorization failure alone enable code execution? The historical pattern suggests this triadic signature (Incorrect Authorization + Scope Changed + conditions beyond attacker's control) has appeared in Adobe CVEs before with extended dwell times — not because attackers struggle with format complexity, but because the trigger condition maps to a specific code path requiring version-matched or configuration-matched payloads. Organizations keep getting surprised because they treat each CVE as a discrete event rather than a node in an evolving exploit architecture. Prioritize patching this based on the CVSS, not the EPSS. The low score likely reflects a modeling blind spot rather than genuine low exploitability.

Reviewed through automated stages and approved by a human before publication.