EUVD-2026-37132
GHSA-q57c-73r4-6g5h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File-based local attack (AV:L, UI:R) with no attacker privileges needed (PR:N); impact is memory disclosure only (C:H, I:N, A:N), unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory contents when a victim opens a specially crafted DNG image file. The attacker requires no privileges of their own - the attack surface is entirely dependent on social engineering a user into opening a malicious file processed by any application embedding the vulnerable SDK. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation.
Technical ContextAI
Adobe DNG SDK is a C++ library used by Adobe and third-party developers to parse and write Digital Negative (DNG) files, Adobe's publicly documented raw image format standard. The root cause is CWE-125 (Out-of-Bounds Read): during parsing of a DNG file, the SDK reads data beyond the allocated buffer boundary, likely due to insufficient validation of a length or offset field embedded in the malformed image structure. The result is that memory contents adjacent to the intended buffer - which may include pointers, keys, or other in-process sensitive data - are accessible to the attacker via the disclosed bytes. CPE cpe:2.3:a:adobe:dng_sdk:*:*:*:*:*:*:*:* covers the affected product range. The 'Buffer Overflow' tag in the source data likely reflects broader buffer mismanagement in the parser rather than a write-primitive overflow, as the confirmed CWE and impact are limited to read and disclosure. CVSS AV:L confirms the attack surface is file-system-based rather than network-exposed.
RemediationAI
Adobe has published security advisory APSB26-67 at https://helpx.adobe.com/security/products/dng-sdk/apsb26-67.html, which should be consulted for the exact patched SDK version, as the available input data does not independently confirm the specific fixed build number beyond the vulnerable ceiling of version 1.7.1 build 2536. Developers embedding the DNG SDK in their products should upgrade to the patched SDK version and rebuild and redistribute their applications to end users. As a compensating control prior to patching, any workflow that automatically processes untrusted DNG files - such as server-side image ingestion pipelines - should be sandboxed (e.g., isolated process with restricted memory access) to limit the blast radius of any memory disclosure. End users can eliminate the attack surface entirely by not opening DNG files received from untrusted sources, since exploitation is conditional on user interaction.
Heap-based buffer overflow in Adobe DNG SDK versions 1.7.1 (build 2536) and earlier enables arbitrary code execution in
Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overfl
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory when a victim opens a
Out-of-bounds memory read in Adobe DNG SDK 1.7.1 build 2536 and earlier enables sensitive process memory disclosure when
Null Pointer Dereference in Adobe DNG SDK versions 1.7.1 build 2536 and earlier allows an attacker to crash any applicat
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corrupti
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today