What is CVE-2021-40776?

CVE-2021-40776 is a medium-severity vulnerability in Adobe Lightroom, classified under Creation of Temporary File in Directory with Insecure Permissions. CVSS score: 6.1/10. Published 2022-06-15.

How severe is CVE-2021-40776?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Adobe Lightroom

CVE-2021-40776

Adobe Lightroom Classic 10.3 (and earlier) are affected by a privilege escalation vulnerability in the Offline Lightroom Classic installer. An authenticated attacker could leverage this vulnerability to escalate privileges. User interaction is required before product installation to abuse this vulnerability.

EPSS: 0.005 (41.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Adobe Lightroom
Adobe Lightroom Classic — versions unspecified
Apple Macos
Microsoft Windows

Weakness classification (CWE)

CWE-379 — Creation of Temporary File in Directory with Insecure Permissions

References

psirt@adobe.com (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2021-40776?: CVE-2021-40776 is a medium-severity vulnerability in Adobe Lightroom, classified under Creation of Temporary File in Directory with Insecure Permissions. CVSS score: 6.1/10. Published 2022-06-15.
How severe is CVE-2021-40776?: Medium severity. CVSS v3 base score is 6.1 out of 10.