{"id":"ASB-A-346797131","details":"In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-346797131","CVE-2025-22423"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-04-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-04-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/dng_sdk/+/748dbd7dfcecb19f3a19caaba4285e059f32d2dd"}],"affected":[{"package":{"name":"platform/external/dng_sdk","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2025-04-01"}]}],"versions":["15-next"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/c3a37d2bb97c78bac71b0293866a2397df00f8b0","target":{"file":"source/dng_ifd.cpp","function":"dng_ifd::ParseTag"},"deprecated":false,"digest":{"length":29200,"function_hash":"292124514316656757492031028141477568026"},"id":"ASB-A-346797131-211cbe7e","signature_type":"Function"},{"id":"ASB-A-346797131-77874c80","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/c3a37d2bb97c78bac71b0293866a2397df00f8b0","target":{"file":"source/dng_ifd.cpp"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["208672506713105172373739116911822014320","77350146005984752882779486110317666313","18756321286853293097438210661910775849","226512580180044837456102984910510736498","15565942549344657871018324394238324927","290985152654726591463878210707806025492","299218795221087280037852351353464286798","285675980618954361851160847246471495360","59096683325698961708889591378635956025","130231004659496891579079062090514800854","8702532287776864963441243655434442831","176557504863404244437421911285817601820"]}}],"fixes":["https://android.googlesource.com/platform/external/dng_sdk/+/c3a37d2bb97c78bac71b0293866a2397df00f8b0"],"severity":"Critical","spl":"2025-04-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-346797131.json"}},{"package":{"name":"platform/external/dng_sdk","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2025-04-01"}]}],"versions":["15"],"ecosystem_specific":{"spl":"2025-04-01","types":["DoS"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/445d85031ac9c1cffd06bf8b3356d9391170a319","target":{"file":"source/dng_ifd.cpp"},"deprecated":false,"digest":{"line_hashes":["208672506713105172373739116911822014320","77350146005984752882779486110317666313","18756321286853293097438210661910775849","226512580180044837456102984910510736498","15565942549344657871018324394238324927","290985152654726591463878210707806025492","299218795221087280037852351353464286798","285675980618954361851160847246471495360","59096683325698961708889591378635956025","130231004659496891579079062090514800854","8702532287776864963441243655434442831","176557504863404244437421911285817601820"],"threshold":0.9},"id":"ASB-A-346797131-2f698fe3"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/445d85031ac9c1cffd06bf8b3356d9391170a319","target":{"file":"source/dng_ifd.cpp","function":"dng_ifd::ParseTag"},"deprecated":false,"digest":{"function_hash":"292124514316656757492031028141477568026","length":29200},"id":"ASB-A-346797131-e0a5e56d"}],"fixes":["https://android.googlesource.com/platform/external/dng_sdk/+/445d85031ac9c1cffd06bf8b3356d9391170a319"],"severity":"Critical"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-346797131.json"}},{"package":{"name":"platform/external/dng_sdk","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2025-04-01"}]}],"versions":["13"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/dng_sdk/+/f2e6d5540ca1eda4d313bf4071a29ef8bffea7f7"],"severity":"Critical","spl":"2025-04-01","types":["DoS"],"vanir_signatures":[{"id":"ASB-A-346797131-8c1f4713","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/f2e6d5540ca1eda4d313bf4071a29ef8bffea7f7","target":{"file":"source/dng_ifd.cpp"},"deprecated":false,"digest":{"line_hashes":["208672506713105172373739116911822014320","77350146005984752882779486110317666313","18756321286853293097438210661910775849","226512580180044837456102984910510736498","15565942549344657871018324394238324927","290985152654726591463878210707806025492","299218795221087280037852351353464286798","285675980618954361851160847246471495360","59096683325698961708889591378635956025","130231004659496891579079062090514800854","8702532287776864963441243655434442831","176557504863404244437421911285817601820"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/f2e6d5540ca1eda4d313bf4071a29ef8bffea7f7","target":{"file":"source/dng_ifd.cpp","function":"dng_ifd::ParseTag"},"deprecated":false,"digest":{"function_hash":"292124514316656757492031028141477568026","length":29200},"id":"ASB-A-346797131-e6a30110"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-346797131.json"}},{"package":{"name":"platform/external/dng_sdk","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2025-04-01"}]}],"versions":["14"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"length":29200,"function_hash":"292124514316656757492031028141477568026"},"id":"ASB-A-346797131-bc146332","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/d11e3fa5130e1cd249e94ba3575a1b6e7903d056","target":{"file":"source/dng_ifd.cpp","function":"dng_ifd::ParseTag"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/dng_sdk/+/d11e3fa5130e1cd249e94ba3575a1b6e7903d056","target":{"file":"source/dng_ifd.cpp"},"deprecated":false,"digest":{"line_hashes":["208672506713105172373739116911822014320","77350146005984752882779486110317666313","18756321286853293097438210661910775849","226512580180044837456102984910510736498","15565942549344657871018324394238324927","290985152654726591463878210707806025492","299218795221087280037852351353464286798","285675980618954361851160847246471495360","59096683325698961708889591378635956025","130231004659496891579079062090514800854","8702532287776864963441243655434442831","176557504863404244437421911285817601820"],"threshold":0.9},"id":"ASB-A-346797131-e71c86e8"}],"fixes":["https://android.googlesource.com/platform/external/dng_sdk/+/d11e3fa5130e1cd249e94ba3575a1b6e7903d056"],"severity":"Critical","spl":"2025-04-01","types":["DoS"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-346797131.json"}}],"schema_version":"1.9.0"}