What is the CVSS score of CVE-2026-34677?

CVE-2026-34677 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34677

EUVD-2026-29776 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-wpx5-pxjj-77qq

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector confirmed by description and CVSS; no privileges needed to supply crafted input; impact is availability-only DoS with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:33 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and earlier allows a local attacker without credentials to exhaust system resources and crash the application. The vulnerability (CWE-400) is limited to a denial-of-service impact with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the SSVC also rates the issue as automatable, suggesting that once triggered, the resource exhaustion path requires minimal attacker effort.

Technical ContextAI

CAI Content Credentials is Adobe's implementation of the Content Authenticity Initiative (CAI) / C2PA (Coalition for Content Provenance and Authenticity) SDK, used by applications to attach, read, and verify provenance metadata embedded in digital media files. CWE-400 (Uncontrolled Resource Consumption) typically arises when the software processes externally supplied input - such as crafted C2PA manifests or credential payloads - without bounding memory allocation, loop iterations, or file parsing depth. The CPE string (cpe:2.3:a:adobe:cai_content_credentials) confirms the affected product is Adobe's SDK library rather than a hosted service, meaning the vulnerability surface is wherever the SDK is integrated into a consuming application. The local attack vector (AV:L) suggests the exploit path involves supplying a maliciously crafted input file or data artifact to the SDK on the local system rather than a remote network socket.

RemediationAI

Upgrade to a version of Adobe CAI Content Credentials above 0.7.0 (and above 0.78.2 if using that branch) as directed by the Adobe security bulletin APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html - consult the advisory for the exact confirmed fix version, as the input data does not specify a patched release number. As a compensating control where immediate patching is not feasible, restrict the SDK's access to only trusted, internally generated content credentials files and block ingestion of externally sourced or user-supplied media in automated pipelines; this mitigates the primary attack path but may reduce the SDK's core utility for verifying third-party content. Additionally, applying OS-level resource limits (e.g., ulimit or cgroup memory caps) on processes running the SDK can bound the blast radius of a triggered DoS to prevent system-wide impact, though the application itself may still crash.