Potheeswaran 
Adobe has rolled out a security update for its Digital Negative (DNG) Software Development Kit, closing six vulnerabilities that span critical remote-code-execution bugs to memory-disclosure and denial-of-service flaws affecting Windows and macOS builds.
Tracked under bulletin APSB26-67, the advisory was first published on June 16, 2026, and has since been revised twice to add newly discovered CVEs, most recently on July 17, 2026.
The update addresses two critical-severity memory-corruption bugs and four important-rated issues in DNG SDK 1.7.1 build 2536 and earlier, all requiring user interaction to trigger.
Adobe Fixes 6 Vulnerabilities
CVE-2026-47964, a heap-based buffer overflow (CWE-122), and CVE-2026-48389, a stack-based buffer overflow (CWE-121), each carry a CVSS score of 7.8 and can lead to arbitrary code execution when a victim opens a maliciously crafted DNG file.
Three separate out-of-bounds read flaws, CVE-2026-47934, CVE-2026-47927, and CVE-2026-47963, rated important with a CVSS score of 5.5, expose sensitive memory contents without granting code execution.
Rounding out the list is CVE-2026-48267, a NULL pointer dereference (CWE-476) that can crash applications relying on the SDK, effectively enabling a denial-of-service condition.
The DNG SDK underpins how countless photo-editing tools, camera firmware, and raw-image pipelines parse Adobe’s Digital Negative format, meaning a single memory-corruption bug here can ripple across third-party software that embeds the library rather than staying confined to Adobe’s own products.
Because DNG SDK code is typically statically linked into downstream applications, developers must rebuild and redistribute their own products once Adobe patches the kit, not just wait for an end-user update, as is common with standalone apps.
Adobe recommends all users and developers upgrade to DNG SDK 1.7.1 build 2611, available through the standard Digital Negative tech notes documentation, and has assigned the update a priority rating of 3, its lowest urgency tier.
The company says it has no evidence of in-the-wild exploitation for any of the six flaws, though the presence of two critical RCE bugs means the risk window remains significant for organizations running outdated builds.
All five publicly attributed CVEs CVE-2026-47934, CVE-2026-47927, CVE-2026-47963, CVE-2026-47964, and CVE-2026-48267 were reported by Brendon Tiszka and Mateusz Jurczyk of Google Project Zero, underscoring the elite research team’s continued focus on Adobe’s imaging codebase.
This is far from an isolated incident for the DNG SDK, which has seen a steady cadence of critical patches throughout 2026, including APSB26-30 in March and APSB26-41 in April, both addressing similar memory corruption classes.
The recurring theme of heap and stack overflows in image-parsing code suggests attackers and researchers alike continue probing legacy C/C++ codebases that handle untrusted file formats, a reminder that raw image tooling remains a soft target for memory-safety issues even as the industry pushes toward safer languages.
Security teams managing photography, digital-asset-management, or camera-firmware pipelines should inventory every application bundling the DNG SDK and prioritize rebuilding against version 1.7.1 build 2611, since patching Adobe’s own tools does nothing to protect third-party software compiled against the vulnerable library.
About the Author
