What is the CVSS score of CVE-2026-34672?

CVE-2026-34672 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34672

EUVD-2026-29774 MEDIUM

Integer Underflow (CWE-191)

2026-05-12 adobe

GHSA-gx86-2pq8-56mw

Denial Of Service Integer Overflow Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local file-processing trigger requires no privileges or interaction; impact is exclusively application availability with no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:28 vuln.today

CVE Published

May 12, 2026 - 20:04 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer underflow in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, with version 0.78.2 also cited) allows an attacker supplying crafted credential payloads to crash the application, producing a denial-of-service condition. The vendor advisory APSB26-53 confirms no user interaction is required for exploitation, though the local attack vector (AV:L) means the malicious payload must reach the SDK through a local processing channel. EPSS sits at 0.01% and CISA SSVC reports exploitation status as none, indicating no public exploit activity at time of analysis.

Technical ContextAI

The CAI (Content Authenticity Initiative) Content Credentials SDK is Adobe's library for embedding and verifying content provenance metadata, used in digital media authentication workflows. CWE-191 (Integer Underflow / Wrap or Wraparound) describes a condition where an integer variable decrements below its minimum representable value, wrapping around to a large positive number. In practice this causes miscalculated buffer sizes, failed allocations, or assertion failures that terminate the application. The CPE string cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:* covers all platforms and versions. The AV:L CVSS vector is consistent with a file-parsing or local-input-processing scenario, where the SDK reads externally supplied content-credential data and the underflow is triggered during integer arithmetic in that parsing path.

RemediationAI

The primary fix is to upgrade CAI Content Credentials to the patched version specified in Adobe security bulletin APSB26-53 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html); the exact fixed version number is not independently confirmed in the available intelligence and must be read directly from that advisory. If patching cannot be done immediately, restrict which users, services, or automated pipelines can supply content to the SDK - specifically, prevent untrusted or externally sourced credential files from reaching the SDK without prior validation or sandboxing. Since the impact is limited to availability (DoS, no data exfiltration), production systems with limited exposure to untrusted input may briefly defer patching with acceptable risk; however, any pipeline that ingests third-party content through this SDK should be treated as higher priority. Also consult NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-34672) and VulDB (https://vuldb.com/vuln/363399) for supplementary patch tracking.