In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-0081 |
Exploitation
The vulnerability can be exploited remotely without user interaction, allowing an attacker to send specially crafted data to the affected system, which may lead to a crash due to uninitialized data in the dng_lossless_decoder component.
Affected Products
- Android devices using the dng_lossless_decoder component, which may be susceptible to remote denial of service attacks.
Mitigation
To mitigate this vulnerability, users should ensure their devices are updated with the latest security patches provided by Android. Additionally, avoiding untrusted sources for applications can help reduce the risk of exploitation.