VDB
CVE-2025-64784
CVE-2025-64784
PUBLISHED
CVSS 7.1 HIGH
DNG SDK | Heap-based Buffer Overflow (CWE-122)
Reported by adobe · Published December 9, 2025
DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| dng_software_development_kit | adobe | 1.7.0 |
| DNG SDK | Adobe | 1.7.0 |
Risk scores
CVSS 3.1
7.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | DNG SDK | 0 |
| Adobe | DNG SDK | 0 |
Timeline
- Dec 9, 2025 CVE Published
- Dec 10, 2025 EPSS Score (30 in total, the first dated here)
- Mar 17, 2026 Security Advisory (3 in total, the first dated here)
- Mar 26, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-64784
vulnetix vdb fixes CVE-2025-64784Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-64784/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart