What is the CVSS score of CVE-2026-34671?

CVE-2026-34671 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34671

EUVD-2026-29773 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-05-12 adobe

GHSA-88vj-6pv7-f632

Denial Of Service Integer Overflow Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector confirmed by description and provided score; no privileges needed to supply crafted input; only availability impacted via application crash.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:28 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application, producing a denial-of-service condition without requiring any user interaction. The flaw is classified under CWE-190 and carries a CVSS 6.2 score with local attack vector, meaning exploitation requires the attacker to be operating in the same local environment as the affected application. No active exploitation has been identified (SSVC: Exploitation: none), and EPSS places this at the 0th percentile, indicating near-zero observed exploitation probability.

Technical ContextAI

CAI Content Credentials is part of Adobe's Content Authenticity Initiative (CAI) SDK - a library used by applications to embed, read, and validate cryptographic content provenance metadata attached to digital media assets. The CPE string cpe:2.3:a:adobe:cai_content_credentials confirms Adobe as the vendor. CWE-190 (Integer Overflow or Wraparound) is the root-cause class: an arithmetic computation produces a result that wraps around the integer boundary, leading to an unexpected memory state or allocation size that ultimately causes the application to crash. Such overflows commonly occur during parsing of size fields in binary or structured metadata payloads, which aligns with the content credentials use case of parsing provenance manifests. The local attack vector (AV:L) suggests the malformed input must be present on the local filesystem or supplied through a local interface rather than over the network.

RemediationAI

The primary remediation is to apply the patch referenced in Adobe security advisory APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. No specific fixed version number was included in the available intelligence data; the exact patched release version should be confirmed directly against the Adobe advisory. If immediate patching is not possible, a compensating control is to restrict local access to the application and prevent untrusted or external content credentials payloads from being processed by the SDK - for example, by sandboxing the application, validating that all processed manifests originate from trusted sources before ingestion, or disabling automatic processing of content credentials from untrusted files. These controls reduce the chance of a malicious payload reaching the vulnerable parsing code but do not eliminate the underlying flaw.