EUVD-2026-56274
GHSA-48jq-gxp5-36cw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector reflects file-ingestion exploitation path; PR:N because supplying a crafted asset requires no system privilege; availability-only impact matches reliable crash with no data or integrity exposure.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker can deliver a crafted C2PA asset file to an application using the affected Rust SDK (≤ c2pa-v0.90.5), JS SDK (≤ @contentauth/c2pa-web@0.12.0), or c2patool CLI (≤ c2patool-v0.27.5) for processing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.2 (Medium) reflects AV:L - exploitation requires supplying a crafted asset to the application's processing pipeline rather than directly attacking a network listener, which substantially limits the realistic attacker population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the vendor-released patched versions: Rust SDK c2pa-v0.90.6, JS SDK @contentauth/c2pa-web@0.12.1, and CLI c2patool-v0.27.6, as confirmed in Adobe advisory APSB26-111 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allo
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today