CVE-2025-64784 DNG SDK | Heap-based Buffer Overflow (CWE-122)

High 7.1 Published 9 Dec 2025 Updated 9 Dec 2025

Heap-based buffer overflow in Adobe DNG SDK allows attackers to disclose memory or cause denial of service via malicious files.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-64784?

CVE-2025-64784 is a high-severity memory corruption vulnerability in Adobe DNG SDK, published on 9 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of service. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Weakness: CWE-122

Which versions are affected by CVE-2025-64784?

It affects 1 product.

Products include Adobe Dng Software Development Kit.

How do I fix CVE-2025-64784?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-64784 being exploited?

There is no known exploitation of CVE-2025-64784 in the wild and no public exploit code.

Sources

Also known as A-483074618, ASB-A-483074618, GHSA-c56v-jqx9-297h.