EUVD-2026-56278
GHSA-7f7v-xhq6-jf8p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed Content Credentials manifest with overflow-triggering integer values
-
DeliveryDeliver crafted media file to target system or pipeline
-
ExploitTarget processes file via c2pa SDK or c2patool
-
ExecutionInteger overflow corrupts internal parser state
-
PersistApplication process crashes
-
ImpactDenial of service achieved
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to supply a crafted file that is subsequently processed by a vulnerable version of the c2pa Rust SDK, c2patool CLI, or @contentauth/c2pa-web JS SDK. The CVSS local attack vector (AV:L) means the crafted file must reach the local execution environment - either through an automated ingestion pipeline accepting untrusted media, a developer running the CLI against attacker-supplied input, or a web service that passes uploaded content to the SDK. No privileges are required to trigger the crash once the file is presented to the parser (PR:N per CVSS), and no user interaction beyond the processing action itself is needed (UI:N). Exploitation is limited by: (1) the local attack vector requiring file delivery to the target system, (2) SSVC non-automatable classification indicating mass exploitation is not straightforward, (3) impact confined to availability only - no code execution or data exposure. Non-automated, interactive use with trusted files is not at practical risk. |
| Impact | The CVSS 3.1 base score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a locally-triggered, high-availability-impact flaw with no confidentiality or integrity consequences. The local attack vector (AV:L) limits scope - an attacker cannot directly trigger this over a network without first delivering a crafted file to a target system. SSVC corroborates: Exploitation is assessed as none, the attack is not automatable, and technical impact is partial. No EPSS data was provided, but the combination of no KEV listing, no public POC, SSVC exploitation:none, and a local-only vector places this in a genuinely low-urgency tier despite the high Availability sub-score. The primary real-world concern is pipeline or batch-processing systems that automatically ingest and validate Content Credentials metadata on untrusted media files - in those deployments, a crafted file could interrupt automated workflows. For interactive desktop use, risk is lower still. This is not a high-priority emergency patch, but should be addressed in the next maintenance cycle for any automated ingestion pipeline. |
| Exploit ScenarioDerived | An attacker crafts a media file (image, video, or PDF) containing a malformed Content Credentials manifest with integer field values designed to trigger an overflow during manifest parsing. When a developer tool, automated pipeline, or web service passes this file to a vulnerable version of c2patool or the c2pa SDK for validation, the overflow corrupts internal state and crashes the process, denying service to that pipeline or tool. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.
RemediationAI
Upgrade to the patched releases confirmed by Adobe advisory APSB26-111: Rust SDK to c2pa-v0.90.6 (update Cargo.toml dependency and re-lock), CLI tool to c2patool-v0.27.6 (replace binary or update via Cargo), and JS SDK to @contentauth/c2pa-web@0.12.1 (update package.json and re-lock npm/yarn). Full advisory is at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. As a compensating control for automated pipelines unable to patch immediately, restrict the file sources processed by c2patool or the SDK to trusted, internally-generated content only - this eliminates the attacker's ability to deliver a crafted file. Do not expose c2patool or SDK-based processing endpoints to untrusted input without patching. Note: restricting input sources requires application-level allowlisting and does not fix the underlying integer overflow.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-190 (Integer Overflow or Wraparound) describes a class of bug where arithmetic on bounded integer types exceeds their representable range, causing the value to wrap to an unexpected result - typically zero or a very large number - that corrupts size calculations, loop bounds, or memory allocation parameters. In media-authenticity libraries like the c2pa Rust SDK and c2pa-web JS/WASM SDK, such overflows most likely occur during parsing of Content Credentials manifests embedded in image or video files, where attacker-controlled length fields or record counts are used in arithmetic without overflow checks. The c2patool CLI wraps the Rust SDK as a command-line interface, inheriting the same flaw. Exact affected versions per EUVD: Rust SDK ≤ c2pa-v0.90.5, CLI ≤ c2patool-v0.27.5, JS SDK ≤ @contentauth/c2pa-web@0.12.0.
Know when C2Pa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local file delivery triggers the overflow without privileges or interaction; impact is availability-only with no scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote att
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resou
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaus
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated r
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthori
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted i
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications t
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resource
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust sys
Exploit-DB