Loading vulnerability…
Out-of-bounds write in Adobe DNG SDK
CVE-2026-27280 is an out-of-bounds write vulnerability affecting Adobe DNG SDK version 1.7.1 build 2471 and earlier. Processing a malicious file can trigger memory corruption and potentially allow arbitrary code execution in the context of the current user. Exploitation requires a victim to open the malicious file. The specific vulnerable function is not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could compromise applications using the affected SDK by executing attacker-controlled code with the current user's permissions, potentially exposing or modifying data and resources accessible to that user.
If you can’t patch tonight, do this now.
Avoid opening untrusted or unexpected files in applications using affected DNG SDK versions. Restrict processing of externally supplied files until a corrected application or SDK is deployed.
Patch, then assume compromise.
A specific fixed DNG SDK version or patch is not identified in the available information. Obtain the applicable security update from Adobe or the vendor of the application incorporating the SDK, and ensure the application uses a corrected SDK version.
1 exploit validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.