{"id":"CVE-2020-9589","aliases":["A-156261521","ASB-A-156261521","EUVD-2020-30379","GHSA-hr6m-jm36-qh4x"],"status":"published","title":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow...","description":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07595,"percentile":0.94587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2020-06-26T19:58:06Z","modified":"2026-11-05T16:32:28Z","fixes":[{"ecosystem":"Android","package":"platform/external/dng_sdk","fixed_in":["8.0:2020-07-01","8.1:2020-07-01","9:2020-07-01","10:2020-07-01"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Android","package":"platform/external/dng_sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0:0"},{"fixed":"8.0:2020-07-01"}]}],"versions":["8.0"]},{"source":"osv","ecosystem":"Android","package":"platform/external/dng_sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1:0"},{"fixed":"8.1:2020-07-01"}]}],"versions":["8.1"]},{"source":"osv","ecosystem":"Android","package":"platform/external/dng_sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9:0"},{"fixed":"9:2020-07-01"}]}],"versions":["9"]},{"source":"osv","ecosystem":"Android","package":"platform/external/dng_sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2020-07-01"}]}],"versions":["10"]}],"products":[{"vendor":"adobe","product":"adobe dng software development kit (sdk)"},{"vendor":"adobe","product":"digital_negative_software_development_kit"}],"references":[{"url":"https://helpx.adobe.com/security/products/dng-sdk/apsb20-26.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9589"},{"url":"https://github.com/advisories/GHSA-hr6m-jm36-qh4x"},{"url":"https://source.android.com/security/bulletin/2020-07-01","tags":["advisory"]},{"url":"https://android.googlesource.com/platform/external/dng_sdk/+/2e8f1f0dc5ca3db8a7035938752dd230608e17ab","tags":["fix"]}],"sources":{"cve":[{"id":"CVE-2020-9589","description":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2020-06-26T19:58:06Z","modified":"2024-08-04T10:34:39.426Z","updated_at":"2026-11-02T14:35:49.538427Z"}],"euvd":[{"id":"EUVD-2020-30379","description":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2020-06-26T19:58:06Z","modified":"2024-08-04T10:34:39Z","updated_at":"2026-11-03T03:07:53.493042Z"}],"ghsa":[{"id":"GHSA-hr6m-jm36-qh4x","title":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow...","description":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-24T17:21:50Z","modified":"2023-01-29T05:03:12Z","updated_at":"2026-11-02T14:45:16.184529Z"}],"nvd":[{"id":"CVE-2020-9589","description":"Adobe DNG Software Development Kit (SDK) 1.5 and earlier versions have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2020-06-26T20:15:12.027Z","modified":"2026-06-17T03:28:12.963Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"ASB-A-156261521","description":"In DecodeImage of dng_lossless_jpeg.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","status":"published","published":"2020-07-01T00:00:00Z","modified":"2026-11-05T16:32:28.703711716Z","updated_at":"2026-11-05T17:55:14.18208Z"}]}}