EUVD-2026-44525
GHSA-2797-9p2f-vf5j
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector confirmed: exploitation requires supplying a crafted file to the parser; no privileges needed; impact is availability-only with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer underflow in Adobe's C2PA Content Credentials SDKs (Rust, JavaScript/Node.js, and CLI tool) allows an attacker to crash the host application by supplying a maliciously crafted C2PA manifest, resulting in a denial-of-service condition. All three release tracks are affected - the Rust SDK (≤0.84.0), the JS SDK (≤0.7.0), and c2patool (≤0.16.5) - with vendor-released patches available for each. No public exploit code has been identified at time of analysis, and EPSS sits at the 5th percentile, consistent with SSVC's 'exploitation: none' assessment.
Technical ContextAI
The Coalition for Content Provenance and Authenticity (C2PA) standard defines a manifest format for attaching provenance metadata to media files. Adobe's open-source implementations - the Rust crate 'c2pa' (CPE: cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), the Node.js package 'c2pa-web' (CPE: cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and the CLI tool 'c2patool' (CPE: cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*) - all expose this flaw. CWE-191 (Integer Underflow/Wrap) indicates that a numeric value is decremented or subtracted below its minimum representable value, causing wraparound. In the context of a manifest parser, this typically occurs when processing a length, offset, or count field that the attacker controls, producing a wildly large or zero value that subsequently causes a crash (e.g., out-of-bounds memory access or panic in Rust's safe mode). The CVSS vector AV:L reflects that the immediate exploitation path is processing a crafted file present in the local file system or supplied to the parsing API, though c2pa-web deployments may expose this path indirectly via network-delivered content.
RemediationAI
Vendor-released patches are available for all three affected components. Upgrade the Rust SDK to c2pa-v0.85.2, the JavaScript/Node.js SDK to @contentauth/c2pa-web@0.9.0, and the CLI tool to c2patool-v0.26.65. Refer to the Adobe Product Security Incident Response Team advisory at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html for official guidance. If immediate patching is not feasible, compensating controls should focus on restricting the source of C2PA manifests: in web-based pipelines, reject or sandbox processing of C2PA-embedded files from untrusted origins before they reach the parsing layer; for CLI-based workflows, restrict execution to manifests from verified, signed sources only. Input validation at ingestion boundaries (e.g., size or schema checks before passing to the SDK) may reduce crash probability but is not a reliable mitigation for parser-level integer underflows and should not substitute for patching.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today