CVE-2026-27258

Received Received - Intake

Out-of-Bounds Write in Adobe DNG SDK Causes DoS

Publication date: 2026-04-14

Last updated on: 2026-04-15

Assigner: Adobe Systems Incorporated

Description

DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-14

Last Modified

2026-04-15

Generated

2026-07-06

AI Q&A

2026-04-14

EPSS Evaluated

2026-07-05

NVD

CVE-2026-27258

EUVD

EUVD-2026-22434

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	dng_software_development_kit	to 1.7.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in DNG SDK versions 1.7.1 2502 and earlier, where an out-of-bounds write can occur. This means that the software writes data outside the boundaries of allocated memory, which can corrupt memory.

An attacker can exploit this vulnerability by tricking a user into opening a malicious file, which then causes the application to crash or become unresponsive.

Impact Analysis

The primary impact of this vulnerability is application denial-of-service. When exploited, it can corrupt memory and cause the affected application to crash or become unresponsive.

This disruption could affect productivity or availability of services relying on the vulnerable software.

Mitigation Strategies

To mitigate this vulnerability, ensure that you do not open malicious files that could exploit the out-of-bounds write in DNG SDK versions 1.7.1 2502 and earlier.

Consider updating to a version of the DNG SDK that is not affected by this vulnerability once such an update is available.

Since exploitation requires user interaction, educating users to avoid opening suspicious or untrusted files can reduce risk.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-27258. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70