What is the CVSS score of CVE-2026-21353?

CVE-2026-21353 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dng Software Development Kit are affected by CVE-2026-21353?

An unpatched integer overflow vulnerability in DNG SDK 1.7.1 and earlier could allow attackers to execute arbitrary code if users open malicious files.

How to fix or mitigate CVE-2026-21353?

Within 24 hours: Identify all systems and applications using DNG SDK versions 1.7.1 2410 or earlier; notify affected business units to avoid opening DNG files from untrusted sources. Within 7 days: Implement application whitelisting or disable DNG file handling where not business-critical; assess whether Adobe or third-party vendors have released updates or workarounds. Within 30 days: Develop a migration plan to patched versions once available; coordinate with software vendors for timeline and deploy as soon as patches are released.

Dng Software Development Kit CVE-2026-21353

HIGH

Integer Overflow or Wraparound (CWE-190)

2026-02-10 psirt@adobe.com

Integer Overflow Dng Software Development Kit

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in DNG SDK 1.7.1 2410 and earlier stems from an integer overflow vulnerability that executes with user privileges when a victim opens a crafted file. The local attack vector requires user interaction but carries high impact across confidentiality, integrity, and availability with no patch currently available.

Technical ContextAI

Classified as CWE-190 (Integer Overflow or Wraparound). Affects Dng Software Development Kit. DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.