A null pointer dereference in Adobe DNG SDK versions 1.7.1 2536 and earlier causes the application to crash when it attempts to use an uninitialized pointer during DNG file parsing. This crash results in a denial‑of‑service condition for any process that loads the SDK. The weakness is a classic null pointer dereference (CWE‑476).

Adobe DNG SDK, versions 1.7.1 2536 and earlier are vulnerable. No newer releases are listed as affected, and the issue is isolated to the SDK component itself.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The flaw requires user interaction: a victim must open a crafted DNG file to trigger the crash. The impact is a denial‑of‑service condition for the application that loads the SDK; the attack is limited to that application context, with no evidence of broader system compromise. Based on the description, it is inferred that the attack requires the victim to open the malicious file, and no remote exploitation without user interaction is documented.