CVE-2025-48622 AI-generated analysis

platform/external/dng_sdk (libdng_sdk, DNG/RAW image parsing), with companion changes in platform/external/skia (src/codec/SkRawCodec.cpp) and platform/cts (tests/camera/libctscamera2jni/dng-validate-jni.cpp)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

Replaces the Android copy of Adobe's DNG SDK (platform/external/dng_sdk) with an import of version 1.7.1 that has JXL and XMP support stubbed out. It also adapts the two in-tree consumers, Skia's SkRawCodec and the CTS dng-validate JNI helper, to the new SDK API.

Root cause

Not identifiable from the diff. The security fix is the commit "Crude DNG SDK 1.7.1 upgrade". It rewrites 159 files (about 61k insertions, 16k deletions) and moves external/dng_sdk from the 1.4-era sources ($Id //mondo/dng_sdk_1_4 headers) to DNG SDK 1.7.1 (kDNGSDK_VersionString "1.7.1", build 2502), with JXL and XMP support crudely removed to avoid new dependencies. The material names no specific vulnerable function. The only concrete defect it describes is in the Skia companion commit: SkDngStream used the dng_stream default offsetInOriginalFile of invalid (-1), which with the new SDK "results in dng_negative hitting a bug path that causes a crash due to unsigned overflow". That is an adaptation to the new SDK, not a demonstrated description of this CVE. The dng_sdk commit also lists "atest CVE_2025_22423" as a test; its relation to this fix is not shown.

How the fix works

• platform/external/dng_sdk 56e64aaa5b59 (Android.bp, source/*): imports the whole DNG SDK 1.7.1 library.
• New files are added to the tree: dng_big_table, dng_bmff, dng_local_string, dng_lossless_jpeg_shared, dng_jxl, dng_update_meta, dng_semantic_mask.h, dng_simd_type.h and dng_deprecated_flags.h. Of these, dng_big_table.cpp, dng_bmff.cpp, dng_local_string.cpp and dng_lossless_jpeg_shared.cpp are added to the Android.bp srcs.
• JXL and XMP are stubbed: the stub header source/jxl/color_encoding.h lets the library compile without libjxl, the dng_jxl.h functions get [[maybe_unused]] (per the commit message), and qDNGUseXMP stays 0.
• Build changes: - -DqDNGUsingSanitizer=1 is added. - -DqAndroid=1 moves to the android target, and -DqLinux=1 is added for host_linux. - -Wno-implicit-fallthrough is added. - libdng_sdk gets sdk_version "current" and stl "c++_shared", and vendor_available is removed. - The windows host build is disabled. - dng_validate_host is removed, and dng_validate now links libdng_sdk statically.
• Representative API changes visible in the platform/external/dng_sdk diff: - dng_1d_table now takes a table count. DNG_REQUIRE checks that it is at least kMinTableSize (512) and a power of two, and table entries are converted with ConvertDoubleToFloat. - dng_1d_table::Interpolate keeps its ThrowBadFormat range check, and UnsafeInterpolate is added. - dng_area_task::Start gains a dstArea parameter. ProcessOnThread and Perform gain a dng_area_task_progress parameter. Tile iteration now goes through MakeTileIterator. - dng_abort_sniffer gains SupportsPriorityWait and a wider dng_priority enum. - dng_bad_pixels gains divide-by-zero guards (count = Max_uint32(count, 1)) and uses snprintf instead of sprintf.
• platform/external/skia 9a77caf186a0, src/codec/SkRawCodec.cpp: - SkDngHost::PerformAreaTask takes the new dng_area_task_progress* parameter, passes area to task.Start and passes nullptr progress to task.ProcessOnThread. - The SkDngStream constructor explicitly calls dng_stream((dng_abort_sniffer*) nullptr, dng_stream::kDefaultBufferSize, 0), so offsetInOriginalFile is 0 instead of the invalid -1 default. - Android.bp: libdng_sdk moves from the common shared_libs to the android shared_libs, and to static_libs for host_linux and darwin.
• platform/cts 4ff6e58c770b, tests/camera/libctscamera2jni/dng-validate-jni.cpp (test-only): - In dng_validate, RawJPEGImage() is replaced by RawLossyCompressedImage(), and imagePreview->fImage.Reset is replaced by imagePreview->SetImage(host, ...). - WriteDNG now uses dngVersion_SaveDefault. - WriteTIFF now takes &negative->Metadata() and render.FinalSpace(profilePtr). For non-monochrome negatives, profilePtr comes from GetProfileByID. - The XMP_NS_CRD and XMP_NS_CRLCP properties are also removed. - validateDngNative now closes pipeFds[0] instead of pipeFds[1], and fails on any stderr output (lineCount > 0) instead of on fewer than 3 lines.

Completeness

• The fix replaces the entire libdng_sdk source tree, so every parser and renderer path in the library now runs the imported 1.7.1 code. The material does not let any single check be identified as the CVE fix.
• JXL and XMP are deliberately stubbed out in this import (stub jxl/color_encoding.h, qDNGUseXMP=0), so those 1.7.1 code paths are not active on Android. The commit message calls the result 'crude' and says it is a cherry-pick of ag/34978264.
• Only two in-tree consumers are adapted: Skia SkRawCodec and the CTS dng-validate helper. The library's vendor_available flag is dropped, and these commits do not cover any other consumer of the old libdng_sdk API.
• The bulletin lists Android 13 as affected, but no Android 13 commit appears in the material.

Behavior changes

• The libdng_sdk API and ABI change. Affected signatures include dng_area_task::Start/ProcessOnThread/Perform, dng_host::PerformAreaTask, the dng_1d_table constructor, dng_negative accessors (RawLossyCompressedImage, Metadata()), dng_image_writer::WriteTIFF/WriteDNG and dng_render::FinalSpace. Consumers must be adapted and rebuilt.
• libdng_sdk is no longer vendor_available and is built with sdk_version "current" and stl "c++_shared". Its windows host variant and the dng_validate_host binary are removed.
• Skia's SkDngStream reports a stream offset of 0 instead of the invalid -1 default. Per the commit comment, this avoids an unsigned-overflow crash path in dng_negative.
• Constructing a dng_1d_table now throws via DNG_REQUIRE if the count is too small or not a power of two.
• The CTS DngCreatorTest native validation now treats any stderr output from dng_validate as a failure.

Per major

• Android 13: Listed as affected by the bulletin. No Android 13 fix commit appears in the material, so its status is unknown.
• Android 14: Same fix: platform/external/dng_sdk 56e64aaa5b59 (Crude DNG SDK 1.7.1 upgrade) in android-security-14.0.0_r24, with companion commits skia 9a77caf186a0 and cts 4ff6e58c770b. 8/8 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: Same fix: platform/external/dng_sdk c210ca6441c5 (Crude DNG SDK 1.7.1 upgrade) in android-security-15.0.0_r12. The visible part of the diff matches Android 14. 8/8 lines are present at android-security-15.0.0_r17.
• Android 16: Same fix: platform/external/dng_sdk de700ad461e3 (Crude DNG SDK 1.7.1 upgrade) in android-security-16.0.0_r3. The visible part of the diff matches Android 14. 8/8 lines are present at android-security-16.0.0_r8.
• Android 17: Not affected per the bulletin. 6/8 lines of the patched region are present at android-security-17.0.0_r1. The material does not show which DNG SDK variant Android 17 carries.

Unknowns

• Which function or parsing path in the old dng_sdk 1.4 sources caused the information disclosure. The fix is a full version upgrade and the material names no specific flaw.
• Whether the SkDngStream offset change (the unsigned-overflow path in dng_negative) is related to the CVE or is only an adaptation to the new SDK.
• How the CVE_2025_22423 test listed in the dng_sdk commit relates to this fix.
• Whether Android 13 received the upgrade, and which DNG SDK variant Android 17 carries.
• Whether other platform or vendor components link libdng_sdk besides Skia and the CTS helper.

Back to December 2025 · Findings