Content Credentials SDK EUVD-2026-100735

Exploitation requires that the target application or workflow use an affected version of the Content Credentials/C2PA tooling - specifically @contentauth/c2pa-web ≤ 0.13.4 (JS SDK), c2pa ≤ 0.90.15 (Rust SDK), or c2patool ≤ 0.27.15 - to perform certificate/signature validation of content credentials. The core limiting factor is the CVSS AC:H condition explicitly stated in the description: exploitation 'depends on conditions beyond the attacker's control,' meaning a specific environmental or certificate-chain state must already be present for the improper validation (CWE-295) to be reachable; the attacker cannot force this state. No user interaction is required (UI:N) and no authentication is needed (PR:N), but impact is confined to integrity - bypassing trust to obtain unauthorized write/attestation - with no confidentiality or availability effect.

This is a moderate-severity, low-urgency issue. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9 MEDIUM) describes a network-reachable, unauthenticated flaw with HIGH attack complexity whose only impact is to integrity (I:H) via unauthorized write access - there is no confidentiality or availability impact. The HIGH attack complexity is directly supported by the description's statement that 'exploit depends on conditions beyond the attacker's control,' meaning a prerequisite environmental state (not attacker-controlled) must hold, which materially lowers reliability of exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so the exploitation status is: no public exploit identified at time of analysis. Signals are internally consistent - there is no conflict between the CVSS vector and the description. The practical risk is bounded: although network and unauthenticated, the AC:H condition plus integrity-only impact (certificate/signature trust bypass rather than code execution or data theft) makes this a credible but not widespread-exploitation priority. Prioritize patching in build pipelines that rely on C2PA provenance trust, but this is not an emergency relative to CRITICAL network RCEs.

An attacker crafts or presents content credentials bearing a certificate that the vulnerable C2PA SDK/tool fails to validate properly (CWE-295), so the forged provenance is accepted as trusted. Because of this improper certificate validation, the attacker gains unauthorized write/attestation capability - effectively forging or tampering with signed content provenance - provided the required non-attacker-controlled conditions are met (CVSS AC:H). No public exploit code or active exploitation is identified at time of analysis.