EUVD-2026-41920
GHSA-fjc5-2qg4-f64g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Malicious file must be opened locally by a victim (AV:L/UI:R); no attacker credentials needed; impact is exclusively application crash with no confidentiality or integrity exposure.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Null Pointer Dereference in Adobe DNG SDK versions 1.7.1 build 2536 and earlier allows an attacker to crash any application embedding the SDK by supplying a specially crafted DNG file. The flaw is strictly a denial-of-service with no confidentiality or integrity impact, and requires a victim to open the malicious file, constraining realistic exposure to imaging pipelines or end-user applications that ingest untrusted DNG content. No public exploit code and no active exploitation have been identified at time of analysis.
Technical ContextAI
The Adobe DNG SDK is an open C++ library that implements reading and writing of Digital Negative (DNG) raw image files, a format Adobe derived from the TIFF/EP standard. The SDK is embedded directly into third-party applications - image editors, digital asset management platforms, camera RAW processors, and ingestion tools - meaning a vulnerability in the SDK propagates to every shipping product that bundles it. The root cause is CWE-476 (NULL Pointer Dereference): a code path in the DNG file parser fails to validate a pointer before dereferencing it. When a crafted DNG file exercises this path, the null dereference generates an unhandled fault that terminates the host application. The CPE cpe:2.3:a:adobe:dng_sdk:*:*:*:*:*:*:*:* confirms the vulnerability spans all platform variants of the SDK at or below version 1.7.1 build 2536.
RemediationAI
The primary fix is to update the Adobe DNG SDK to the version specified in Adobe advisory APSB26-67 at https://helpx.adobe.com/security/products/dng-sdk/apsb26-67.html; the exact patched build number should be confirmed directly from that advisory, as it was not present in the source intelligence. Developers and ISVs who have statically linked or bundled the DNG SDK into their products must rebuild and redistribute updated application binaries. As an interim compensating control, restrict DNG file ingestion pipelines to accept files only from verified, trusted sources - for example, by enforcing allowlisted upload origins or sandboxing the parsing process so a crash does not affect broader system availability. Sandboxing carries the trade-off of added operational complexity. No workaround can eliminate the null dereference itself; isolation limits blast radius only.
Heap-based buffer overflow in Adobe DNG SDK versions 1.7.1 (build 2536) and earlier enables arbitrary code execution in
Arbitrary code execution in Adobe DNG SDK version 1.7.1 (build 2536) and earlier arises from a stack-based buffer overfl
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory when a victim opens a
Out-of-bounds memory read in Adobe DNG SDK 1.7.1 build 2536 and earlier enables sensitive process memory disclosure when
Out-of-bounds read in Adobe DNG SDK 1.7.1 build 2536 and earlier exposes sensitive process memory contents when a victim
Out-of-bounds write in Adobe DNG SDK 1.7.1 2502 and earlier causes application denial-of-service through memory corrupti
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today