Product:
DNG SDK
Summary
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-21355 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious file that, when opened by a victim using the affected DNG SDK, triggers the out-of-bounds read. This requires the victim to interact with the file, making user awareness and caution essential to prevent exploitation.
Affected Products
- DNG SDK versions 1.7.1 2410 and earlier are vulnerable to memory exposure due to an out-of-bounds read.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure they are using the latest version of the DNG SDK. Regular updates and security patches from Adobe should be applied promptly to protect against known vulnerabilities.