Adobe DNG SDK CVE-2025-64894

Exploitation requires a victim to open an attacker-crafted malicious DNG file within an application that uses Adobe DNG SDK version 1.7.0 or earlier; the integer overflow (CWE-190) is triggered during parsing of that file. Limiting factors: the CVSS vector is AV:L with UI:R, so the attacker cannot trigger this remotely without the user's action of opening the file, and the impact is confined to availability (C:N/I:N/A:H) - a crash or unresponsive application - with no code execution, data disclosure, or integrity compromise claimed. No authentication is required (PR:N), but the dependence on local user interaction substantially narrows realistic exploitation.

This is a moderate-severity, low-priority issue rather than a high-impact threat. The CVSS 3.1 base score is 5.5 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, meaning the only impact is availability (a crash or hang) with no confidentiality or integrity loss, and exploitation requires local vector plus user interaction (opening a malicious file). The EPSS score is very low at 0.17% (6th percentile), indicating a low estimated probability of exploitation in the wild. There is no CISA KEV listing and no public exploit identified, so there is no evidence of active exploitation - all signals (low EPSS, no KEV, no POC, availability-only impact) consistently point to a non-urgent, low real-world risk despite the medium CVSS. One note for defenders: the vector states AV:L (local) while PR:N (no privileges), which is internally consistent for a file-parsing bug where the 'attacker' supplies a file the victim opens locally; this is correctly a local, user-interaction-gated DoS rather than a remotely automatable exploit.

An attacker crafts a malicious DNG (Digital Negative) image file engineered to trigger an integer overflow in the DNG SDK's parsing logic, then delivers it to a victim via email, a download, or a shared workspace. When the victim opens the file in an application that embeds the vulnerable DNG SDK (version 1.7.0 or earlier), the overflow causes the application to crash or hang, producing a denial-of-service. No public exploit code has been identified at time of analysis.