What is the CVSS score of CVE-2026-34667?

CVE-2026-34667 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34667

EUVD-2026-29769 MEDIUM

Integer Underflow (CWE-191)

2026-05-12 adobe

GHSA-j459-g2p9-qq6p

Denial Of Service Integer Overflow Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local-only trigger via crafted input, no privileges needed, purely an availability impact with no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:31 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer underflow (CWE-191) in Adobe's CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application and cause a denial-of-service condition. No user interaction is required, and the SSVC assessment classifies the vulnerability as automatable, meaning reliable exploitation can be scripted. EPSS sits at 0.01% with SSVC exploitation status of 'none', and no active exploitation or public exploit code has been identified at time of analysis - real-world risk is correspondingly low despite the 'Automatable: yes' SSVC flag.

Technical ContextAI

CWE-191 describes an Integer Underflow where an arithmetic operation produces a value below the minimum representable integer, causing it to wrap to a very large positive value. In the context of Adobe's Content Authenticity Initiative (CAI) Content Credentials SDK - an application-layer library for attaching and verifying cryptographic content provenance metadata - such a wraparound could corrupt internal length or size calculations during credential parsing or processing, resulting in an unrecoverable error that crashes the host application. The CPE string cpe:2.3:a:adobe:cai_content_credentials identifies this as an Adobe application-class product rather than an OS or firmware component. The local attack vector (AV:L) suggests the underflow is triggered by supplying crafted input to the SDK on the local system, likely via a malformed content credentials file or data stream.

RemediationAI

Apply the vendor-released patch per Adobe security advisory APSB26-53, available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. An exact fixed version number was not confirmed in the available intelligence data - consult the advisory directly for the target upgrade version. If immediate patching is not possible, reduce risk by restricting which users or processes can supply content credentials files to the SDK, limiting local access to the processing environment, and sandboxing or containerizing applications that invoke the SDK to bound the DoS blast radius. These compensating controls do not eliminate the vulnerability but contain its impact to the sandboxed process rather than the broader host.