What is the CVSS score of CVE-2026-34670?

CVE-2026-34670 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34670

EUVD-2026-29772 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-gfj8-93rh-jrhr

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector confirmed by description; no privileges needed to supply malformed input; impact is availability-only with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:32 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper input validation in Adobe's CAI Content Credentials SDK (versions 0.78.2 and 0.7.0 and earlier) allows a local attacker to crash the application by supplying malformed content credential data, resulting in a denial-of-service condition. The flaw requires no user interaction and no special privileges beyond local access to provide input to the application. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but SSVC flags exploitation as automatable once access is achieved.

Technical ContextAI

CAI Content Credentials is Adobe's SDK implementing the C2PA (Coalition for Content Provenance and Authenticity) standard, used to attach and verify cryptographic provenance metadata to digital media assets. The affected CPE is cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:*. CWE-20 (Improper Input Validation) indicates the library fails to sufficiently sanitize or bound-check crafted input - most likely a malformed C2PA manifest or credential structure - before processing it, triggering an unhandled error path that terminates the application. The vulnerability affects at least two distinct version branches: 0.7.x (up to and including 0.7.0) and a more recent branch at 0.78.2, suggesting the flaw exists in a shared parsing component across maintained release lines.

RemediationAI

Upgrade to a patched version of the CAI Content Credentials SDK as specified in Adobe security advisory APSB26-53 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html). The advisory does not list an explicit fixed version number in the provided intelligence data, so consult APSB26-53 directly to confirm the target upgrade version before deploying. As a compensating control where immediate patching is not feasible, restrict which processes or users can supply credential files to applications embedding this SDK, and validate that untrusted or externally-sourced content credential files are not passed directly to the parsing path without prior sanitization. If the SDK is used in a media ingestion pipeline that accepts user-uploaded files, consider sandboxing or isolating the parsing worker process to limit DoS blast radius to that component rather than the host application.