CVE-2026-48267

Received Received - Intake

NULL Pointer Dereference in Adobe DNG SDK

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: Adobe Systems Incorporated

Description

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-06

Generated

2026-07-07

AI Q&A

2026-07-07

EPSS Evaluated

N/A

NVD

CVE-2026-48267

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	dng_sdk	to 1.7.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Impact Analysis

The primary impact of this vulnerability is a denial-of-service (DoS) condition. When exploited, it causes the affected application to crash, making it unavailable to the user.

Since exploitation requires user interaction (opening a malicious file), the risk depends on the likelihood of such an event occurring.

Executive Summary

This vulnerability exists in DNG SDK versions 1.7.1 2536 and earlier, where a NULL Pointer Dereference can occur. This means that the software attempts to access or use a memory location that is not properly initialized, causing the application to crash.

An attacker can exploit this by tricking a user into opening a malicious file, which triggers the vulnerability and results in the application crashing.

Mitigation Strategies

To mitigate this vulnerability, avoid opening malicious files that could exploit the NULL Pointer Dereference in affected DNG SDK versions 1.7.1 2536 and earlier.

Since exploitation requires user interaction, educating users to not open suspicious or untrusted files can reduce risk.

Additionally, updating to a version of the DNG SDK later than 1.7.1 2536, if available, would help prevent this issue.

Hi! I’m here to help you understand CVE-2026-48267. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70