CVE-2024-20754: Lightroom Desktop | Untrusted Search Path (CWE-426)
Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-20754?
CVE-2024-20754 has a critical severity level due to its potential for arbitrary code execution.
How do I fix CVE-2024-20754?
To fix CVE-2024-20754, upgrade to Adobe Lightroom version 7.2 or later.
What software versions are affected by CVE-2024-20754?
Adobe Lightroom Desktop versions 7.1.2 and earlier are affected by CVE-2024-20754.
What is an Untrusted Search Path vulnerability like CVE-2024-20754?
An Untrusted Search Path vulnerability allows attackers to execute arbitrary code by manipulating the application’s search path.
What condition allows the exploitation of CVE-2024-20754?
Exploitation of CVE-2024-20754 occurs when Lightroom uses an insecure search path to locate critical resources.