CVE-2026-47964: DNG SDK | Heap-based Buffer Overflow (CWE-122)

Synopsis

A heap-based buffer overflow affects Adobe DNG SDK versions 1.7.1 2536 and earlier. The vulnerability is reached locally and requires no authentication, but a victim must open a malicious file for exploitation to succeed. Successful exploitation gives an attacker arbitrary code execution running as the current user, enabling full read, write, and control of whatever that process can access. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationNot required

  No account or credentials are needed to deliver the malicious file to a victim.

• Victim interactionRequired

  A victim must open a specially crafted file, making social engineering or malicious file delivery a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental factors beyond convincing the victim to open the file.

Blast Radius

• The attacker executes arbitrary code in the context of the user who opened the malicious file.
• All files, secrets, and credentials readable by that user process are exposed.
• Any data writable by that user process can be modified or deleted, including application data and configuration files.
• The affected process can be crashed or hijacked, disrupting any service or workflow running under that user account.