EUVD-2026-65624
GHSA-cf86-7hgp-8xxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable parser with no auth or interaction required; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required for exploitation: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is remotely exploitable over the network without authentication and without any user interaction, against default deployments of the affected SDK. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a remotely exploitable, low-complexity, unauthenticated denial-of-service - the highest-risk profile for an availability-only flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a crafted C2PA manifest or content credential payload with a malformed size or offset field to a network-accessible service using Adobe's Content Credentials Rust SDK. The malformed value triggers an integer underflow during parsing, causing the SDK to compute an invalid memory address or buffer length, which panics or crashes the application process. … |
| Remediation | Consult Adobe security advisory APSB26-110 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html) to obtain the exact patched release version for both the C2PA Tool and the Content Credentials Rust SDK, then upgrade all affected deployments promptly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Adobe Content Credentials Rust SDK or C2PA Tool, including third-party dependencies or SaaS integrations relying on this technology. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Crede
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Cred
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processin
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today