Technical impact
An out-of-bounds read flaw exists in the Adobe DNG SDK that lets a malicious file cause the software to read memory beyond a valid buffer, potentially exposing sensitive data. The vulnerability is classified as CWE-125 and leads to disclosure of confidential information. This is not a code execution or denial‑of‑service fault, but it can leak secrets held in the target process memory.
Affected Systems
Adobe Digital Negative Software Development Kit versions 1.7.1, 2410, and earlier are affected. All installations that compile or use these SDK binaries are potentially vulnerable if they process external DNG files.
Risk and Exploitability
The CVSS base score of 5.5 indicates moderate severity, and the EPSS value of less than 1% suggests a low likelihood of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalog, implying no confirmed widely‑used exploits as of now. An attacker must provide a malicious DNG file and convince a user to open it, so the attack vector is user‑interaction‑dependent and likely limited to workstations or devices that handle DNG content.
