What is the CVSS score of CVE-2026-47963?

CVE-2026-47963 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Adobe DNG SDK CVE-2026-47963

EUVD-2026-37135 MEDIUM

Out-of-bounds Read (CWE-125)

2026-06-16 adobe

GHSA-2r87-8x7j-8ppq

Buffer Overflow Information Disclosure Adobe Dng Sdk

5.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

AV:L for file-based local delivery, UI:R for mandatory victim file-open, PR:N as no credentials are needed, C:H for potential sensitive memory leakage, with I:N and A:N as no write or crash impact applies.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 19:08 vuln.today

DescriptionCVE.org

DNG SDK versions 1.7.1 2536 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory when a victim opens a specially crafted Digital Negative (DNG) image file. The vulnerability is confined to information disclosure - no code execution or data modification is achievable - and requires local file delivery combined with explicit user interaction, as reflected by the CVSS AV:L/UI:R metrics. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a moderate-priority patching target, though risk scales with how broadly the SDK is embedded in applications that process untrusted DNG files.

Technical ContextAI

Adobe DNG SDK is a C++ library used by imaging software to parse and process Digital Negative (DNG) raw image files - a format originally developed by Adobe and widely used in professional photography pipelines. CWE-125 (Out-of-Bounds Read) indicates that during DNG file parsing, the SDK reads memory beyond the bounds of an allocated buffer, likely caused by insufficient validation of attacker-controlled offset or length fields embedded in the file structure. This class of bug is typical of binary format parsers that trust file-derived size values without bounding checks. The affected CPE cpe:2.3:a:adobe:dng_sdk:*:*:*:*:*:*:*:* covers all platform variants of the SDK through version 1.7.1 build 2536, and any application statically or dynamically linking against this SDK version inherits the vulnerability.

RemediationAI

Upgrade Adobe DNG SDK to a version beyond 1.7.1 build 2536 by consulting Adobe Security Bulletin APSB26-67 at https://helpx.adobe.com/security/products/dng-sdk/apsb26-67.html for the confirmed fixed build number - the exact patched version is not independently stated in the available data and should be verified directly against the advisory before deployment. Vendors and developers embedding the DNG SDK in their own products must rebuild and release updated application packages linked against the patched SDK. Where immediate upgrade is not feasible, restrict the application's ability to open DNG files from untrusted or external sources - for example, by rejecting DNG inputs at ingestion boundaries, enforcing allowlists of trusted file origins, or running the file-parsing component in a sandboxed process with limited memory visibility. Note that these compensating controls reduce exposure but do not eliminate the vulnerability, and may disrupt workflows dependent on processing externally sourced DNG content.