CVE-2026-21353: Critical Integer Overflow Vulnerability in platform/external/dng_sdk
Summary
CVE-2026-21353: In multiple functions of dng_jxl.cpp, there is a possible integer overflow due to memory corruption. Affects platform/external/dng_sdk across 5 version ranges.
>= 14:0, < 14:2026-06-01
>= 15:0, < 15:2026-06-01
>= 16:0, < 16:2026-06-01
>= 16-qpr2:0, < 16-qpr2:2026-06-01
>= 17-next:0, < 17-next:2026-06-01
Fixed in 17-next:2026-06-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The platform/external/dng_sdk is a software development kit (SDK) used in Android for processing digital negative (DNG) images. It provides functionalities for decoding and manipulating image data, making it essential for applications that handle photographic content. However, this SDK has been found to be vulnerable to an integer overflow issue, which can lead to serious security implications.
Vulnerability Detail
The vulnerability arises from an integer overflow in multiple functions within the dng_jxl.cpp file of the dng_sdk. This overflow can result in memory corruption, potentially allowing an attacker to escalate privileges locally without requiring additional execution privileges. The exploitation of this vulnerability does not necessitate user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
17-next:2026-06-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit the use of the affected functions in dng_jxl.cpp until the patch can be applied. Additionally, consider implementing input validation to mitigate the risk of exploitation.
Conclusion
The CVE-2026-21353 vulnerability in the platform/external/dng_sdk poses a critical risk due to its potential for privilege escalation through integer overflow. Immediate action is recommended to update the SDK to the patched version to mitigate this risk.
See every vulnerability recorded for platform/external/dng_sdk →
FAQ
CVE-2026-21353 is a critical vulnerability identified in the platform/external/dng_sdk that allows for integer overflow leading to memory corruption and potential privilege escalation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner. This tool allows you to monitor and alert for open-source vulnerabilities in your software without requiring installation.
The primary risk is local privilege escalation, which could allow an attacker to gain unauthorized access to sensitive data or system functionalities.
No, user interaction is not required for exploitation, making it a significant security concern.
If immediate updates are not possible, consider implementing input validation and limiting the use of affected functions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/external/dng_sdk.
