Adobe DNG SDK CVE-2025-64783

Exploitation requires a victim to open a maliciously crafted DNG (Digital Negative) image file in an application that uses Adobe DNG SDK version 1.7.0 or earlier; the integer overflow is triggered during parsing of that file. Key limiting factors: the attack vector is local/file-based (AV:L), not remote network-reachable, and mandatory user interaction (UI:R) means the attacker cannot execute code without the victim actively opening the file. No authentication or special privileges are needed on the attacker side (PR:N), but exposure is constrained to environments that actually process untrusted DNG files with the vulnerable SDK, and code runs only with the privileges of the current user (no privilege escalation or scope change).

This is a genuine but context-dependent code-execution flaw rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) is internally consistent with the description: the attack vector is Local because exploitation occurs when a victim opens a malicious DNG file (not over a network service), and the base score of 7.8 is driven entirely by the high confidentiality/integrity/availability impact of arbitrary code execution in the current user's context. The EPSS score is low (0.21%, 10th percentile), which aligns with the lack of any KEV listing and no identified public exploit - all signals point the same direction, so there is no conflict to flag here. The practical risk hinges on user interaction (opening a crafted file), so this is a client-side/file-parsing risk typical of integer-overflow (CWE-190) flaws in media-handling libraries. Priority should be moderate: patch in environments where the DNG SDK processes untrusted image files, but this is not a high-urgency, internet-facing, wormable issue. One note of caution: because Adobe DNG SDK is an embedded library, downstream applications bundling it may need separate patching, and exposure depends on which products ship the vulnerable 1.7.0-or-earlier code.

An attacker crafts a malicious DNG (raw image) file engineered to trigger an integer overflow in the DNG SDK's parsing logic and delivers it to a victim via email, a download, or a shared asset. When the victim opens the file in an application that uses the vulnerable SDK (versions 1.7.0 or earlier), the overflow leads to memory corruption and arbitrary code execution in the context of that user. No public exploit code has been identified at time of analysis, and successful exploitation requires the victim to open the file (UI:R).