CVE-2026-27258

CVE-2026-27258 is an out-of-bounds write vulnerability affecting Adobe DNG SDK versions 1.7.1 2502 and earlier. This memory corruption flaw could allow an attacker to crash or render an application unresponsive through a maliciously crafted file. The vulnerability carries a CVSS score of 5.5 (Medium severity) with a local attack vector requiring no special privileges but necessitating user interaction to open a malicious file. The impact is limited to availability, with no confidentiality or integrity implications, though successful exploitation could cause application denial-of-service through memory corruption. There are no indicators of active exploitation at this time. The vulnerability is not included in CISA's Known Exploited Vulnerabilities catalog, has not appeared on any active hot lists, and maintains an exceptionally low EPSS score of 0.00028, indicating minimal real-world exploitation probability. Community attention remains minimal, suggesting this remains a lower-priority vulnerability for immediate patching efforts.