What is the CVSS score of CVE-2026-34679?

CVE-2026-34679 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34679

EUVD-2026-29778 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-hwq3-m532-jv2m

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local input delivery required (AV:L, PR:N); no complexity or interaction barriers once positioned; impact is availability-only crash with no scope change.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:32 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service via improper input validation in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application without requiring any privileges or user interaction. The root cause is CWE-20 (Improper Input Validation), meaning the SDK fails to adequately reject or sanitize malformed input before processing it. No active exploitation has been identified (SSVC: Exploitation none; EPSS: 0.01%), and impact is limited strictly to availability - there is no confidentiality or integrity exposure.

Technical ContextAI

The Adobe CAI Content Credentials SDK is part of the Content Authenticity Initiative (CAI), a framework for embedding and verifying cryptographic provenance metadata (C2PA manifests) in media files. The affected CPE is cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:*, covering all versions through at least 0.7.0 and also version 0.78.2. The root cause class is CWE-20 (Improper Input Validation), meaning the SDK does not properly reject or sanitize crafted input before acting on it, allowing a specially crafted payload to trigger an unhandled state that crashes the application process. The CVSS vector AV:L indicates the malicious input must be supplied locally (e.g., via a crafted media file or API call on the same host), and AC:L confirms no special preconditions or timing are needed once access is established.

RemediationAI

Consult Adobe Security Bulletin APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html for the patched release version; the exact fixed version number is not stated in the available intelligence data, so verify directly with Adobe. Applications embedding the CAI Content Credentials SDK should update to the fixed release as soon as it is confirmed. As a compensating control where patching is delayed, restrict the set of inputs processed by the SDK to trusted, pre-validated sources - for example, gating media file processing behind an upstream format validator or access control layer that prevents untrusted files from reaching the SDK. This limits the attack surface but does not eliminate the underlying flaw. Note that the advisory is also indexed at https://nvd.nist.gov/vuln/detail/CVE-2026-34679 and https://vuldb.com/vuln/363400.