CVE-2025-64784

CWE-122 — Heap-based Buffer Overflow4 documents4 sources
Severity
7.1HIGH
EPSS
0.0%
top 87.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Platform External/dng SDKAdobe DNG SDKAdobe DNG Software Development KIT
Timeline
PublishedDec 9
Latest updateMar 1

Description

DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶Androidplatform/external/dng_sdk16-qpr2-next:0 — 16-qpr2-next:2026-03-01+4
▶CVEListV5adobe/dng_sdk1.7.0

🔴Vulnerability Details

3
OSV
CVE-2025-64784: In multiple locations, there is a possible way to access unexpected data due to multiple causes↗2026-03-01
▶
CVEList
DNG SDK | Heap-based Buffer Overflow (CWE-122)↗2025-12-09
▶
GHSA
GHSA-c56v-jqx9-297h: DNG SDK versions 1↗2025-12-09
▶
CVE-2025-64784 (HIGH CVSS 7.1) | DNG SDK versions 1.7.0 and earlier | cvebase.io