EUVD-2026-56276
GHSA-h7f9-qg9v-qp9w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SDK processes attacker-supplied media over the network with no authentication gate; crash impact is availability-only with no data exposure or scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.
Technical ContextAI
The Coalition for Content Provenance and Authenticity (C2PA) specification defines a cryptographic mechanism for embedding and verifying provenance metadata - 'Content Credentials' - inside media files such as images, video, and audio. Adobe's open-source SDK ecosystem implements this specification across three components: a Rust crate (c2pa), a WebAssembly/JavaScript wrapper (@contentauth/c2pa-web), and a command-line tool (c2patool). CWE-476 (NULL Pointer Dereference) is the root cause class: the parsing or processing logic fails to guard against a null pointer before dereferencing it, a defect common in C/Rust code paths that handle variable-length or optional fields in complex binary/structured formats. Because C2PA metadata is embedded in attacker-controlled media files, any application that accepts external content for credential verification exposes the vulnerable parsing surface directly to untrusted input.
RemediationAI
Upgrade to vendor-released patched versions immediately: Content Credentials Rust SDK c2pa-v0.90.6, Content Credentials Command-Line Tool c2patool-v0.27.6, and Content Credentials JS SDK @contentauth/c2pa-web@0.12.1 - all confirmed in Adobe's advisory APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. For applications where immediate patching is not feasible, restrict the sources of media files accepted for C2PA credential verification to trusted, internally-controlled origins only, thereby eliminating attacker-controlled input from reaching the vulnerable parser; note that this workaround may not be viable for services whose core function is processing externally submitted content. Additionally, deploying the application behind a process supervisor with automatic restart (e.g., systemd, Kubernetes liveness probes) limits sustained service outage from repeated crash attempts but does not prevent individual disruptions and should not substitute for patching.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allo
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today