Adobe DNG SDK CVE-2025-64893

Exploitation requires that a victim open an attacker-supplied malicious DNG (Digital Negative) file in an application built on the Adobe DNG SDK version 1.7.0 or earlier; there is no remote, unauthenticated, zero-click path. The decisive limiting factors are: (1) the LOCAL attack vector (AV:L) - the attacker cannot reach the parser over a network without first delivering a file; (2) mandatory user interaction (UI:R) - a human must actively open the crafted file; and (3) the victim application must actually embed the vulnerable DNG SDK. These constraints meaningfully reduce real-world exploitability despite the HIGH confidentiality and availability impact.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H, base 7.1 HIGH) is internally consistent with the description: exploitation is LOCAL (AV:L) and requires user interaction (UI:R) because a victim must open a malicious DNG file - this is file-parsing abuse, not remote network exploitation. The high CVSS is driven by C:H (memory disclosure of sensitive data) and A:H (denial of service via crash) on an out-of-bounds read (CWE-125). All exploitation signals point AWAY from active mass exploitation: EPSS is only 0.18% (7th percentile, i.e. low predicted exploitation probability), the CVE is NOT in CISA KEV, and no public PoC is indicated in the provided data. These signals are mutually consistent - there is no conflict between a low EPSS and KEV status because there is no KEV listing. The result is a legitimately high-severity memory-safety flaw whose real-world risk is bounded by the need to socially engineer a victim into opening a crafted file; it is a 'high CVSS, moderate real-world urgency' case. Note the provided reference points to Adobe bulletin APSB25-118, while Adobe DNG SDK advisories are sometimes numbered differently - verify the exact bulletin ID and fixed version with Adobe before citing it.

An attacker crafts a malicious DNG (Digital Negative) image file that triggers an out-of-bounds read in the DNG SDK's parsing code and distributes it via email, a web download, or a shared photo library. When a victim opens the file in an application that embeds the vulnerable DNG SDK (≤1.7.0), the flaw either leaks adjacent process memory - potentially exposing sensitive data - or crashes the application (DoS). No public exploit code is identified in the provided data, and success requires the victim to open the file (UI:R).