Adobe DNG SDK CVE-2025-64784

Exploitation requires a victim to open an attacker-crafted malicious image file (DNG/raw) in an application that embeds the Adobe DNG Software Development Kit version 1.7.0 or earlier; the overflow is triggered during file parsing. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) - there is no remote/network trigger - and it is gated on user interaction (UI:R), so the attacker must rely on social engineering to get the file opened. No special product configuration is required beyond using a vulnerable SDK version to parse the file.

Signals converge on a moderate, not urgent, priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1) describes a local, low-complexity, unauthenticated-but-user-interaction-dependent flaw: the attacker cannot reach it over a network and must convince a victim to open a malicious file, which materially caps weaponizability. EPSS is low at 0.20% (9th percentile), consistent with the local/UI-gated nature and indicating no observed mass-exploitation pressure. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not confirmed actively exploited. The impact is real but bounded - high confidentiality (heap memory disclosure, usable for info-leak/ASLR bypass) and high availability (crash/DoS), but no integrity impact and no documented path to code execution in the input. Net: a legitimately high-CVSS memory-safety bug whose real-world risk is tempered by requiring local file-open interaction and showing no exploitation activity. No key signals conflict; the primary gap is the absence of POC/KEV data (absence, not contradiction).

An attacker crafts a malicious DNG (or other image) file and delivers it via email, download, or a shared library, relying on social engineering to get a victim to open it in an application built on the Adobe DNG SDK. Parsing the malformed file triggers a heap-based buffer overflow that leaks adjacent heap memory (potentially sensitive data) or crashes the application. No public exploit code has been identified at time of analysis.