CVE-2026-27258
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
An out-of-bounds write vulnerability in DNG SDK versions 1.7.1 2502 and earlier could lead to application denial-of-service. An attacker could leverage this to corrupt memory, causing the application to crash or become unresponsive. Exploitation requires user interaction – the victim must open a malicious file.
Risk Assessment
The risk is that the application may crash or hang, disrupting DNG image processing. The attack requires the user to open a malicious file, which limits the risk but still poses a threat.
Recommendation
It is recommended to update DNG SDK to the latest version that includes a fix. Also, avoid opening files from unknown or untrusted sources.
Other vulnerabilities in DNG SDK
See all- CVE-2026-34620Medium
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34616Medium
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48389High
DNG SDK versions 1.7.1 2536 and earlier are affected by a stack-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – opening a malicious file.
- CVE-2026-48267Medium
DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-27281Medium
DNG SDK versions 1.7.1 2471 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-21355Medium
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.
- CVE-2026-21354Medium
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation requires user interaction – the victim must open a malicious file.
Original NVD description (English source)
DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker could leverage this vulnerability to corrupt memory, causing the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.