CVE-2025-0081: Critical Denial of Service Vulnerability in platform/external/dng_sdk
Summary
CVE-2025-0081: In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. Affects platform/external/dng_sdk across 6 version ranges.
>= 12:0, < 12:2025-03-01
>= 12L:0, < 12L:2025-03-01
>= 13:0, < 13:2025-03-01
>= 14:0, < 14:2025-03-01
>= 15:0, < 15:2025-03-01
>= 15-next:0, < 15-next:2025-03-01
Fixed in 15-next:2025-03-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The platform/external/dng_sdk is an Android library that provides support for decoding and processing DNG (Digital Negative) images. It is widely used in applications that require high-quality image processing. However, this library has been found to contain a critical vulnerability that can lead to a denial of service, affecting the stability and usability of applications that rely on it.
Vulnerability Detail
In the dng_lossless_decoder::HuffDecode function of dng_lossless_jpeg.cpp, there exists a flaw due to uninitialized data. This vulnerability can be exploited to cause a crash, leading to a remote denial of service without requiring any additional execution privileges. User interaction is not necessary for exploitation, making it a significant risk for applications using this library.
How To Fix
Minimum fixed version
15-next:2025-03-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as possible.
Conclusion
The CVE-2025-0081 vulnerability in the platform/external/dng_sdk poses a critical risk of denial of service due to uninitialized data. It is essential to update to the patched versions to ensure the stability and security of applications relying on this library.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2025-0081 is a critical vulnerability in the platform/external/dng_sdk that can lead to a denial of service due to uninitialized data in the dng_lossless_decoder::HuffDecode function.
Exploitation of this vulnerability can cause your application to crash, leading to a denial of service for users without any additional privileges required.
No, user interaction is not needed for exploitation, making it a significant risk for applications using the affected library.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
