CVE-2025-64894

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-10

Assigner: Adobe Systems Incorporated

Description

DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this issue to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-10

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64894

EUVD

EUVD-2025-202260

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	dng_sdk	1.7.0
adobe	dng_software_development_kit	to 1.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, avoid opening untrusted or suspicious files with affected versions of the DNG SDK (version 1.7.0 and earlier). Ensure that user interaction with potentially malicious files is minimized. Consider updating to a later version of the DNG SDK if available, or apply any patches provided by the vendor once released.

Executive Summary

This vulnerability is an Integer Overflow or Wraparound in DNG SDK versions 1.7.0 and earlier. It can be exploited when a user opens a malicious file, causing the application to crash or become unresponsive, resulting in a denial-of-service condition.

Impact Analysis

The vulnerability can cause the affected application to crash or become unresponsive, leading to denial-of-service. This disrupts normal operation and availability of the application.

Hi! I’m here to help you understand CVE-2025-64894. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70