CVE-2025-64893 — Out-of-bounds Read in External DNG SDK

CWE-125 — Out-of-bounds Read4 documents4 sources
Severity
7.1HIGHNVD
EPSS
0.1%
top 82.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Platform External DNG SDKAdobe DNG SDKAdobe DNG Software Development KIT
Timeline
PublishedDec 9
Latest updateMar 1

Description

DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages3 packages

▶Androidplatform/external_dng_sdk16-qpr2-next:0 — 16-qpr2-next:2026-03-01+4
▶CVEListV5adobe/dng_sdk1.7.0

🔴Vulnerability Details

3
OSV
CVE-2025-64893: In multiple locations, there is a possible way to access unexpected data due to multiple causes↗2026-03-01
▶
CVEList
DNG SDK | Out-of-bounds Read (CWE-125)↗2025-12-09
▶
GHSA
GHSA-pw68-r5f5-2vhg: DNG SDK versions 1↗2025-12-09
▶
CVE-2025-64893 — Out-of-bounds Read in External DNG SDK | cvebase