EUVD-2026-65624
GHSA-cf86-7hgp-8xxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted C2PA manifest over network
-
DeliverySDK parses malformed size/offset field
-
ExploitInteger underflow wraps to invalid value
-
ExecutionApplication process panics or crashes
-
ImpactService denied to legitimate users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | No special conditions are required for exploitation: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that the vulnerability is remotely exploitable over the network without authentication and without any user interaction, against default deployments of the affected SDK. The primary limiting factor is deployment context - the attack surface exists only in applications that accept and parse C2PA manifest or content credential data from untrusted or external sources. Applications that use the SDK solely for signing or in offline/internal pipelines not exposed to untrusted input have a substantially reduced attack surface. No specific non-default configuration is required to be vulnerable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a remotely exploitable, low-complexity, unauthenticated denial-of-service - the highest-risk profile for an availability-only flaw. The impact is bounded: there is no confidentiality or integrity component, so data exfiltration or code execution are not indicated by available data. EPSS data was not provided, which limits probabilistic exploitation forecasting. The vulnerability is absent from CISA KEV and no public exploit code has been identified, suggesting it has not been actively weaponized. Real-world urgency depends heavily on deployment context: applications that expose C2PA manifest parsing to untrusted input (e.g., public-facing content authenticity verification APIs) face meaningful denial-of-service risk, while offline or internal tooling has a far smaller attack surface. Even a small media-platform operator relying on Adobe's SDK for content provenance workflows should treat this as an urgent patch given the zero-authentication exploit path, even if the overall threat landscape currently shows no active exploitation. |
| Exploit ScenarioDerived | An attacker sends a crafted C2PA manifest or content credential payload with a malformed size or offset field to a network-accessible service using Adobe's Content Credentials Rust SDK. The malformed value triggers an integer underflow during parsing, causing the SDK to compute an invalid memory address or buffer length, which panics or crashes the application process. The service becomes unavailable until restarted, and repeated submissions keep it down indefinitely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
RemediationAI
Consult Adobe security advisory APSB26-110 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html) to obtain the exact patched release version for both the C2PA Tool and the Content Credentials Rust SDK, then upgrade all affected deployments promptly. The input data does not specify an exact fix version, so the patch version must be confirmed directly from the advisory before upgrading. If immediate patching is not feasible, compensating controls should focus on restricting access to the C2PA manifest parsing surface: place the service behind an authenticated API gateway to eliminate the unauthenticated remote attack vector, enforce input size limits and content-type validation at the ingestion layer to reduce the likelihood of triggering the underflow, and implement process supervision (e.g., systemd Restart=on-failure) to minimize downtime from crash loops. Note that input filtering is a partial mitigation only, as the exact trigger payload shape is unknown without a POC; authentication is the most reliable interim control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in two Adobe components: the c2pa_tool (cpe:2.3:a:adobe:c2pa_tool) and the content_credentials_rust_sdk (cpe:2.3:a:adobe:content_credentials_rust_sdk), both implementing the C2PA (Coalition for Content Provenance and Authenticity) specification for embedding and verifying content provenance metadata. CWE-191 (Integer Underflow / Wrap or Wraparound) occurs when an arithmetic operation produces a result below the minimum value representable by the integer type, causing it to wrap to a very large value. In a Rust SDK context, this could arise during parsing of C2PA manifest structures or byte-length calculations if an attacker supplies malformed credential data that causes an underflow in a size or offset field, leading to an out-of-bounds read or invalid memory state that panics the application. Rust's default debug builds trap on overflow, but release builds with wrapping arithmetic can silently produce corrupt state that causes downstream crashes.
Know when C2Pa Tool gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable parser with no auth or interaction required; impact is availability-only with no confidentiality or integrity consequence.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe's Content Credentials Rust SDK and C2PA Tool contain an integer underflow vulnerability (CVE-2026-71442, CVSS 7.5) that enables unauthenticated remote attackers to trigger denial-of-service conditions against any service processing C2PA content credentials. This threatens organizational availability for applications dependent on content authenticity verification. With no vendor-released patch currently available, this requires immediate risk assessment and interim controls to prevent service disruptions.
Restrict network access to services processing C2PA data using firewall rules or network segmentation; implement rate-limiting and request throttling on credential validation endpoints; apply strict input validation and sanitization to all incoming C2PA structures before SDK processing; consider disabling C2PA verification if not operationally critical; establish enhanced logging and alerting for unusual request patterns or unexpected application crashes that may indicate exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Crede
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Cred
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processin
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Exploit-DB