An out‑of‑bounds write in Adobe’s DNG SDK allows an attacker who can supply a specially crafted DNG file to overwrite memory beyond allocated buffers. If the write is successful, the attacker can execute arbitrary code with the privileges of the user running the software. The vulnerability is identified as CWE‑787 and requires that a victim opens a malicious file, so it is a user‑interaction–required flaw but still capable of compromising system integrity.

Adobe DNG SDK versions 1.7.1 or earlier (build 2410 and earlier) are affected. Systems that rely on these SDK versions, such as Adobe applications or any custom integrations embedding the SDK, remain vulnerable until an updated version is deployed.

The CVSS score of 7.8 indicates high severity, and the EPSS score of less than 1% suggests exploitation is currently unlikely but not impossible. Because exploitation requires a user to open a crafted DNG file, the attack vector is a social engineering or supply‑chain approach, potentially through email attachments or compromised software bundles. The vulnerability is not listed in the CISA KEV catalog, so there is no publicly confirmed exploitation at the time of this analysis.