Executive brief
Adobe's DNG SDK, a software toolkit used by developers to handle digital image files, contains a security flaw that could allow unauthorized access to system memory. An attacker could exploit this by tricking a user into opening a specially crafted malicious file. If successful, this could lead to the exposure of sensitive information stored in the computer's memory.
Technical details
An out-of-bounds read vulnerability (CWE-125) exists in Adobe DNG SDK versions 1.7.1 2536 and earlier. The flaw occurs when the SDK processes a malformed DNG file, leading the application to read data past the end of the intended buffer. An attacker can exploit this by providing a crafted file to a user; upon opening the file, the application may leak sensitive information from the process memory. The attack vector is local and requires user interaction (UI:R), with a high impact on confidentiality but no impact on integrity or availability.
Affected products
- Adobe DNG SDK 1.7.1 2536 and earlier
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory