CVE-2026-21352: Critical Arbitrary Code Execution Vulnerability in platform/external/dng_sdk
Summary
CVE-2026-21352: In multiple locations, there is a possible way to achieve arbitrary code execution due to memory corruption. Affects platform/external/dng_sdk across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The platform/external/dng_sdk is a software development kit used in Android applications for handling digital negative (DNG) image formats. It provides functionalities for image processing and manipulation, making it essential for applications that require high-quality image handling. However, this package has been found to contain a critical vulnerability that could allow attackers to execute arbitrary code remotely, posing significant security risks to applications utilizing this SDK.
Vulnerability Detail
The vulnerability arises from memory corruption issues present in multiple locations within the dng_sdk. This flaw can be exploited to achieve arbitrary code execution without requiring additional execution privileges or user interaction. Attackers can leverage this vulnerability to execute malicious code remotely, potentially compromising the integrity and confidentiality of the affected systems.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected functionalities of the dng_sdk until the patch is applied. This may involve disabling certain features or implementing additional security checks to prevent unauthorized access.
Conclusion
The CVE-2026-21352 vulnerability in the platform/external/dng_sdk poses a significant risk due to its potential for arbitrary code execution. It is critical for developers to update to the patched versions to ensure the security of their applications. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2026-21352 is a critical vulnerability in the platform/external/dng_sdk that allows for arbitrary code execution due to memory corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing workarounds such as restricting access to the affected functionalities.
Failing to address this vulnerability could lead to unauthorized code execution, data breaches, and potential compromise of user data and application integrity.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the gradle.lockfile. More information can be found at https://vulert.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
