What is the CVSS score of CVE-2026-34665?

CVE-2026-34665 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of CAI Content Credentials are affected by CVE-2026-34665?

Adobe's Content Authenticity Initiative SDK versions 0.78.2 and earlier contain an uncontrolled resource consumption vulnerability enabling unauthenticated attackers to cause application crashes.

How to fix or mitigate CVE-2026-34665?

Within 24 hours, audit all systems for Content Credentials SDK deployment and enable detailed monitoring for resource exhaustion events. Within 7 days, implement application-level rate limiting on untrusted input processing, enforce strict memory and CPU quotas per process, and deploy comprehensive input validation before SDK processing. Within 30 days, establish patch deployment procedures for when vendor fixes become available and evaluate alternative content authenticity libraries if vendor timeline exceeds organizational risk tolerance.

CAI Content Credentials CVE-2026-34665

EUVD-2026-29767 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-gvm3-m33q-m4vq

Denial Of Service Adobe Cai Content Credentials

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable SDK parsing untrusted input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:31 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

HIGH 7.5

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK versions 0.78.2, 0.7.0 and earlier lets a remote unauthenticated attacker exhaust system resources and crash the application (availability-only denial-of-service). No public exploit is identified at time of analysis and EPSS probability is negligible (0.01%), but SSVC flags the attack as automatable, so exploitation could be scripted once a vector is understood. Confidentiality and integrity are not impacted.

Technical ContextAI

CAI Content Credentials is Adobe's implementation of the Content Authenticity Initiative / C2PA standard, used to embed and verify cryptographically-signed provenance metadata (Content Credentials) in media assets. The flaw is classed as CWE-400 (Uncontrolled Resource Consumption), the root-cause family in which an application fails to bound the CPU, memory, or other resources it allocates while processing attacker-influenced input - here most plausibly during parsing or verification of crafted media/manifest data. The single affected CPE, cpe:2.3:a:adobe:cai_content_credentials, confirms this is an application-layer library/SDK issue rather than an OS or firmware component; a malformed or oversized input that triggers unbounded work would drive the process toward resource exhaustion and denial-of-service.

RemediationAI

Upgrade to the fixed release identified in Adobe advisory APSB26-53 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html) - consult that advisory for the exact patched version, as a specific fix version is not enumerated in the available intelligence and should not be guessed. Because this is a library/SDK, rebuild and redeploy any application that bundles it. Where immediate patching is not possible, apply compensating controls at the boundary where untrusted media is processed: enforce strict input size limits and processing timeouts on assets submitted for Content Credentials parsing/verification (trade-off - very large legitimate assets may be rejected), rate-limit or queue requests to the SDK so a single client cannot saturate resources (trade-off - added latency under load), and, where feasible, restrict or authenticate access to the endpoints that feed untrusted input into the SDK (trade-off - reduces open/public usability). These reduce exposure but do not remove the underlying flaw; patching remains the durable fix.