What is the CVSS score of CVE-2026-34688?

CVE-2026-34688 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials CVE-2026-34688

EUVD-2026-29782 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-4rx8-22xh-j5gp

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local input access alone triggers the crash with no privileges needed; impact is availability-only with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:30 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Adobe CAI Content Credentials SDK versions 0.7.0 and earlier contain an improper input validation flaw that enables a local, unprivileged attacker to crash the application and cause a denial-of-service condition without any user interaction. The local attack vector (AV:L) confines exploitation to hosts where the SDK is installed and accepting input, which materially limits the threat surface despite the SSVC Automatable:yes classification. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) confirms near-zero empirical exploitation probability.

Technical ContextAI

The Adobe CAI Content Credentials SDK (CPE: cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:*) implements Adobe's Content Authenticity Initiative, providing digital provenance and tamper-evidence tracking for media assets. The vulnerability is rooted in CWE-20 (Improper Input Validation), a class of flaws where an application fails to properly constrain, validate, or sanitize input before processing it - allowing malformed or boundary-exceeding data to trigger unhandled exceptions or resource exhaustion. In this case, the SDK does not adequately validate supplied content before processing, allowing a specially crafted input to crash the application process rather than returning a graceful error. The impact is purely an availability loss with no confidentiality or integrity exposure, consistent with the CVSS C:N/I:N/A:H metric profile.

RemediationAI

Consult the Adobe security advisory APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html for the exact patched release version - the available data does not specify a fixed version number, so the remediated release cannot be independently confirmed at time of analysis. Upgrade to the version identified in APSB26-53 as the primary remediation. As a compensating control prior to patching, restrict local system access to hosts running the CAI Content Credentials SDK, enforcing least-privilege policies to minimize the set of principals who can supply input to the application. For automated media processing pipelines, implement upstream input validation and sanitization before data reaches the SDK; note this may introduce processing latency but prevents malformed payloads from reaching the vulnerable code path. Monitor for unexpected SDK process exits as an indicator of potential exploitation attempts.