CVE-2026-27258
Received Received - Intake
Out-of-Bounds Write in Adobe DNG SDK Causes DoS

Publication date: 2026-04-14

Last updated on: 2026-04-15

Assigner: Adobe Systems Incorporated

Description
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-14
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-15
EPSS Evaluated
2026-06-15
NVD
CVE-2026-27258
EUVD
EUVD-2026-22434
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
adobe dng_software_development_kit to 1.7.1 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, ensure that you do not open malicious files that could exploit the out-of-bounds write in DNG SDK versions 1.7.1 2502 and earlier.

Consider updating to a version of the DNG SDK that is not affected by this vulnerability once such an update is available.

Since exploitation requires user interaction, educating users to avoid opening suspicious or untrusted files can reduce risk.

Executive Summary

This vulnerability exists in DNG SDK versions 1.7.1 2502 and earlier, where an out-of-bounds write can occur. This means that the software writes data outside the boundaries of allocated memory, which can corrupt memory.

An attacker can exploit this vulnerability by tricking a user into opening a malicious file, which then causes the application to crash or become unresponsive.

Impact Analysis

The primary impact of this vulnerability is application denial-of-service. When exploited, it can corrupt memory and cause the affected application to crash or become unresponsive.

This disruption could affect productivity or availability of services relying on the vulnerable software.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-27258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart