CVE-2026-21353
Published: 10 February 2026
Summary
CVE-2026-21353 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Adobe Dng Software Development Kit. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, prioritization, and timely patching of the integer overflow flaw in DNG SDK as detailed in Adobe's APSB26-23 bulletin.
Mandates validation of file inputs to prevent integer overflows from maliciously crafted DNG files processed by the vulnerable SDK.
Implements memory safeguards such as ASLR and DEP to block arbitrary code execution resulting from successful integer overflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow in image SDK enables RCE when user opens crafted DNG file (direct match to malicious file user execution).
NVD Description
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…
more
victim must open a malicious file.
Deeper analysisAI
CVE-2026-21353 is an Integer Overflow or Wraparound vulnerability (CWE-190) affecting Adobe DNG SDK versions 1.7.1 2410 and earlier. The flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but necessitates user interaction (UI:R) in the form of opening a malicious file. A successful attack achieves high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within the user's scope (S:U), earning a CVSS v3.1 base score of 7.8.
Adobe's security bulletin APSB26-23, available at https://helpx.adobe.com/security/products/dng-sdk/apsb26-23.html, addresses this issue with details on patches and mitigation.
Details
- CWE(s)