What is the CVSS score of CVE-2026-34668?

CVE-2026-34668 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34668

EUVD-2026-29770 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-7x5h-hgv7-h2xp

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector confirmed by nature of SDK input processing; PR:N as no authenticated session is needed to supply crafted input; availability-only impact aligns with application crash behavior.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:31 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Local denial-of-service in Adobe CAI Content Credentials SDK versions 0.7.0 and earlier (including 0.78.2) allows an attacker with local access to crash the application by supplying maliciously crafted input, triggering an improper input validation flaw (CWE-20). No user interaction is required to exploit the vulnerability, though exploitation is constrained to local attack vectors per the CVSS:3.1 AV:L designation. EPSS sits at 0.01% (1st percentile) and SSVC exploitation status is confirmed 'none', indicating no public exploit or active exploitation identified at time of analysis.

Technical ContextAI

CAI Content Credentials is Adobe's implementation of the Content Authenticity Initiative (CAI) SDK, used for embedding and validating content provenance and authenticity metadata (C2PA manifests) in digital media assets. The affected component is identified via CPE as cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:*. The root cause is CWE-20 (Improper Input Validation) - the SDK fails to adequately validate or sanitize input before processing, allowing malformed data to trigger an unhandled condition that terminates the application. Because the SDK operates on local media files or data streams, the attack surface is constrained to local file or process interaction rather than remote network exposure. The unchanged scope (S:U) confirms the crash is contained to the vulnerable process itself without cascading to other system components.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in Adobe Security Bulletin APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. An exact fixed version number is not independently confirmed from the available reference data - consult the advisory directly to identify the minimum safe version for your release branch (0.7.x or 0.78.x). If immediate patching is not feasible, restrict local system access to the application's process environment so that only trusted users and processes can supply input to the SDK; this directly addresses the AV:L exploitation vector. Additionally, consider sandboxing or containerizing the SDK process to limit the blast radius of an availability impact - a crash in an isolated container does not propagate to the host. Note that input filtering at the application layer may be an option but is not a reliable substitute for the vendor patch given that the flaw is in input validation itself.