Adobe Content Credentials CVE-2026-19480

Exploitation requires the attacker to supply a crafted asset or Content Credentials manifest that is processed by the Adobe Content Credentials Rust SDK or its command-line tool; the malformed input evades the SDK's input validation to bypass the intended security control. No authentication and no user interaction are required (PR:N/UI:N). The practical limit is scope of impact and reach: the effect is confined to unauthorized write/forgery of Content Credentials provenance data (I:H, C:N/A:N), and exposure depends on an application or workflow actually invoking the SDK/CLI to validate attacker-supplied content - meaningful mainly to systems that rely on these credentials for media authenticity/trust decisions.

This is a legitimate but bounded integrity risk. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5) describes an unauthenticated, low-complexity, no-interaction path to an integrity-only impact - the attacker gains unauthorized write access by bypassing a security/validation check, with no confidentiality or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so exploitation status is 'no public exploit identified at time of analysis' - the 7.5 rating reflects potential severity, not observed activity. One caveat to verify: the affected products are a Rust SDK and a command-line tool for Content Credentials (C2PA provenance), which are typically invoked to process a supplied asset/manifest; the AV:N rating is defensible if the crafted asset is delivered over a network but could arguably be AV:L in file-only/CLI usage - verify the exposure path with Adobe APSB26-147. Because the impact is confined to forging or writing Content Credentials (undermining media provenance/trust) rather than code execution or data theft, this is a moderate, provenance-integrity concern rather than a top-tier emergency for most environments.

An attacker crafts a malicious asset or Content Credentials manifest with input that evades the SDK's validation logic. When the Rust SDK or command-line tool processes it, the improper input validation lets the attacker bypass the intended security control and gain unauthorized write access - forging or tampering with content-provenance credentials without authentication or user interaction. No public proof-of-concept is available at time of analysis.