Description
DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-07-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Adobe DNG SDK versions 1.7.1 2536 and earlier contain a stack-based buffer overflow that can be triggered by processing a specially crafted DNG file. The overflow allows an attacker to execute arbitrary code with the privileges of the user who opens the file, potentially compromising the system if that user has elevated rights. This weakness is classified as CWE-121 and requires the victim to interact with a malicious file to initiate exploitation.

Affected Systems

Adobe DNG SDK, specifically versions 1.7.1 2536 and all earlier releases, are affected. No other Adobe products are listed as impacted.

Risk and Exploitability

The vulnerability has a CVSS score of 7.8, indicating a high severity risk. The EPSS score is less than 1%, reflecting a very low overall probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog, and it requires user interaction to be triggered. However, if exploited, the attacker gains execution capability within the victim's user context, which could lead to full system compromise for privileged users.

Generated by OpenCVE AI on July 30, 2026 at 18:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Adobe DNG SDK to a version newer than 1.7.1 2536
  • If an immediate upgrade is not possible, avoid opening untrusted DNG files and consider disabling DNG support in applications that use the SDK
  • Implement file integrity checks or sandbox the DNG processing environment to limit potential exploitation

Generated by OpenCVE AI on July 30, 2026 at 18:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe dng Sdk
Vendors & Products Adobe
Adobe dng Sdk

Mon, 20 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Description DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title DNG SDK | Stack-based Buffer Overflow (CWE-121)
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Dng Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-07-23T03:56:22.942Z

Reserved: 2026-05-21T15:28:38.143Z

Link: CVE-2026-48389

cve-icon Vulnrichment

Updated: 2026-07-20T18:49:32.187Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T18:45:06Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow