EUVD-2026-56273
GHSA-99xw-7776-rq87
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector because exploitation requires a crafted file to reach the parser; PR:N as no privileges needed post-delivery; availability-only impact with no confidentiality or integrity loss.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target application must be running one of the unpatched SDK versions - Rust c2pa ≤0.90.5, @contentauth/c2pa-web ≤0.12.0, or c2patool ≤0.27.5 - and must parse an attacker-controlled C2PA manifest file. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 6.2 Medium score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H correctly frames this as a local-vector availability-only issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade immediately to the patched versions confirmed by Adobe APSB26-111: Rust SDK to c2pa-v0.90.6 (via Cargo.toml update), JavaScript SDK to @contentauth/c2pa-web@0.12.1 (via npm/yarn upgrade), and CLI tool to c2patool-v0.27.6 (via direct binary replacement or package manager). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Same weakness CWE-191 – Integer Underflow
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today