What is the CVSS score of CVE-2026-34666?

CVE-2026-34666 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34666

EUVD-2026-29768 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-7f83-f365-c52q

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local attack vector with no privileges required aligns with SDK input handling; impact is availability-only with no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:33 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper input validation in Adobe CAI Content Credentials (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application, producing a denial-of-service condition without requiring user interaction. The vulnerability stems from insufficient validation of attacker-supplied input processed by the SDK, classified under CWE-20. With an EPSS of 0.01% (1st percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low, though SSVC notes the attack is automatable once local access is achieved.

Technical ContextAI

Adobe CAI Content Credentials is part of Adobe's Content Authenticity Initiative (CAI) SDK, used to attach, read, and verify cryptographic provenance metadata (C2PA-based content credentials) to digital media assets. The affected product is identified via CPE cpe:2.3:a:adobe:cai_content_credentials. CWE-20 (Improper Input Validation) indicates the root cause is a failure to adequately sanitize or constrain input before it is consumed by the SDK's parsing or processing logic - a common class of defect in data-ingestion libraries where crafted or malformed credential payloads can trigger unhandled exceptions or resource exhaustion, ultimately crashing the host application.

RemediationAI

The primary remediation is to apply the patch referenced in Adobe Security Bulletin APSB26-53, available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. An exact fixed version number is not independently confirmed from the input data provided - consult the advisory directly to identify the specific patched SDK release. As a compensating control where patching is not immediately feasible, restricting which local processes or users are permitted to invoke the CAI SDK or submit credential payloads to it can reduce the attack surface; however, this may impact legitimate content authenticity workflows. Organizations operating the SDK within automated media processing pipelines should assess whether the DoS risk warrants temporary suspension of the affected pipeline component until patching is complete.