Executive brief
Adobe's DNG SDK is a software library used to process and decode DNG (Digital Negative) image files, commonly used by photographers and imaging software. This vulnerability allows attackers to read sensitive data from memory by crafting a malicious image file. When a user opens the crafted file, the attacker can extract confidential information such as encryption keys, passwords, or other sensitive data stored in the application's memory.
Technical details
The vulnerability is an out-of-bounds read in Adobe DNG SDK versions 1.7.1 2410 and earlier that occurs during image file processing. The issue allows reading memory beyond allocated buffer boundaries, enabling information disclosure of sensitive data resident in process memory. Exploitation requires user interaction—a victim must open a specially crafted DNG or related image file. The attack is network-accessible if the file is delivered via email or web download, but does not require authentication or special privileges on the target system. A successful exploit could expose cryptographic material, session tokens, or other sensitive information depending on what data is in memory at the time of exploitation.
Affected products
- Adobe DNG SDK 1.7.1 2410 and earlier
Timeline
- 2026-02-10: disclosed