EUVD-2026-65623
GHSA-q2gq-hfv4-pmxr
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector is consistent with file-based input processing; PR:N reflects no privilege requirement to supply a file; C:N and I:N match crash-only DoS with no code execution path.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a system running Adobe's c2pa_tool or content_credentials_rust_sdk and the ability to supply a specially crafted C2PA manifest file to the processing pipeline. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.2 score reflects a moderate-severity, local-only vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a media file embedding a C2PA manifest with a malformed integer field engineered to underflow the SDK's size or offset computation during parsing. When this file is supplied to a content authenticity pipeline or operator invoking the c2pa_tool or Rust SDK locally, the underflow causes the application to crash, interrupting the content verification workflow. … |
| Remediation | Apply the patch detailed in Adobe security advisory APSB26-110, available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html - the advisory should be consulted directly for exact fixed version numbers, as they were not independently confirmed in available intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Crede
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Cred
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Same weakness CWE-191 – Integer Underflow
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today