.

Adobe Security Bulletin

Last updated on Feb 17, 2026

Security update available for Adobe DNG Software Development Kit (SDK) | APSB26-23

Bulletin ID
Date published
Priority
APSB26-23
February 10, 2026
3
style
grid width 12

Summary

Adobe has released an update for the Adobe DNG Software Development Kit (SDK) for Windows and macOS. This update resolves critical and important vulnerabilities that could lead to arbitrary code execution and memory exposure, or application denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Affected version
Platform
Adobe DNG Software Development Kit (SDK)
DNG SDK 1.7.1 build 2410 and earlier versions
All
style
grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product
Updated version
Platform
Priority rating
Availability
Adobe DNG Software Development Kit (SDK)
DNG SDK 1.7.1 build 2471
All
3
Tech Note
style
grid width 12

Vulnerability Details

Vulnerability category
Vulnerability impact
Severity
CVSS base score
CVSS vector
CVE number
Out-of-bounds Write (CWE-787)
Arbitrary Code Execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21352
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21353
Integer Overflow or Wraparound (CWE-190)
Application denial-of-service
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2026-21354
Out-of-bounds Read (CWE-125)
Memory exposure
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2026-21355

Acknowledgments

Adobe would like to thank the following researchers for reporting these issue and for working with Adobe to help protect our customers:

  • Brendon Tiszka and Mateusz Jurczyk of Google Project Zero - CVE-2026-21352, CVE-2026-21353, CVE-2026-21354
  • Ruikai - CVE-2026-21355

NOTE: Adobe has a public bug bounty program. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.

Revisions

  • February 17, 2026: Corrected solution version
CardTitle
APSB26-23
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-02-10
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/adobe-dng-sdk
Arbitrary
search: CVE-2026-21352 CVE-2026-21353 CVE-2026-21354 CVE-2026-21355