What is the CVSS score of EUVD-2026-29771?

EUVD-2026-29771 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials EUVD-2026-29771

| CVE-2026-34669 MEDIUM

Improper Input Validation (CWE-20)

2026-05-12 adobe

GHSA-g3c8-mf8p-4p7h

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local-only trigger via crafted input with no privilege barrier; impact is strictly availability via application crash, with no confidentiality or integrity exposure.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:29 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe CAI Content Credentials versions 0.7.0 and earlier (and additionally 0.78.2 per the CVE description) stems from improper input validation (CWE-20) that allows a local unprivileged attacker to crash the application without requiring user interaction. The vulnerability carries a CVSS 6.2 base score with local attack vector and high availability impact, but no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS exploitation probability is 0.01%, and CISA SSVC reports exploitation status as none - placing this squarely in routine patch cycle territory.

Technical ContextAI

CAI Content Credentials is Adobe's SDK implementing the Content Authenticity Initiative (CAI), used for embedding and validating digital content provenance metadata in creative workflows. The root cause is CWE-20 (Improper Input Validation), where the application fails to adequately sanitize or bound-check attacker-controlled input prior to processing, resulting in an unhandled condition that terminates the application. The affected CPE is cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:* with no upper version bound currently specified in NVD CPE data. The local attack vector (AV:L) indicates the flaw is triggered via locally-supplied input, most likely crafted credential files or command-line arguments passed to the SDK, rather than over a network interface.

RemediationAI

Apply the update described in Adobe Security Bulletin APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. A patch is available per vendor advisory, though the exact fixed release version was not independently confirmed from the provided intelligence data - consult the bulletin directly to identify the target upgrade version. As a compensating control pending upgrade, restrict local user and process access to the CAI Content Credentials application binary and its input pathways, such as limiting write permissions on directories from which credential files are sourced, to reduce the set of principals capable of supplying crafted input. This workaround narrows the attack surface but does not eliminate the underlying vulnerability.