EUVD-2026-37134
GHSA-xqpm-76p4-c28h
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file-open required (AV:L, UI:R); attacker needs no system privileges to craft the file (PR:N); read-only memory disclosure with no write or crash impact (I:N, A:N).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds memory read in Adobe DNG SDK 1.7.1 build 2536 and earlier enables sensitive process memory disclosure when a victim opens a specially crafted DNG raw image file. The vulnerability is local-vector, requiring attacker-controlled file delivery and victim interaction, making phishing or malicious file distribution the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a medium-priority information disclosure risk consistent with its CVSS 5.5 rating.
Technical ContextAI
Adobe DNG SDK (Digital Negative Software Development Kit) is a C++ library Adobe provides for developers to parse and process DNG raw image files - an open standard for camera raw images. CWE-125 (Out-of-Bounds Read) indicates the parser reads past the allocated buffer boundary when processing a malformed DNG file, likely in a crafted tag, tile, or strip dimension field within the DNG/TIFF structure. The CPE cpe:2.3:a:adobe:dng_sdk:*:*:*:*:*:*:*:* confirms this affects the SDK itself - meaning any application embedding DNG SDK versions through 1.7.1 build 2536 (such as Adobe camera tools, Lightroom Classic, or third-party imaging software) inherits this vulnerability. The tags include 'Buffer Overflow' alongside 'Information Disclosure', suggesting the read overrun could expose heap or stack memory adjacent to the image buffer, potentially leaking pointers or sensitive data from the host process.
RemediationAI
Update Adobe DNG SDK to the version released with or after Adobe advisory APSB26-67 (https://helpx.adobe.com/security/products/dng-sdk/apsb26-67.html). The exact fixed version number is not independently confirmed from the available input data - consult the APSB26-67 advisory directly for the patched SDK release identifier. For applications embedding the DNG SDK, rebuild and redeploy against the patched SDK version. As a compensating control where immediate patching is not feasible, restrict which users or processes can open DNG files, disable automatic DNG file preview in file managers, and use sandboxing or containerization to limit what memory a DNG-processing process can access - reducing the blast radius of a successful read. Note that sandboxing adds operational overhead and may break application functionality if the process requires broad system access. Server-side batch DNG ingestion pipelines should implement file-source allowlisting to reduce exposure to attacker-supplied files.
Heap-based buffer overflow in Adobe DNG SDK versions 1.7.1 (build 2536) and earlier enables arbitrary code execution in
Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overfl
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory when a victim opens a
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory contents when a victim
Null Pointer Dereference in Adobe DNG SDK versions 1.7.1 build 2536 and earlier allows an attacker to crash any applicat
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corrupti
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today