What is the CVSS score of EUVD-2026-29775?

EUVD-2026-29775 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials EUVD-2026-29775

| CVE-2026-34673 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-12 adobe

GHSA-fmmj-449g-8xvh

Denial Of Service Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector (AV:L) confirmed by description and CVSS; no privileges needed to submit crafted input to the SDK; only availability is impacted via resource exhaustion.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:30 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe CAI Content Credentials (versions 0.78.2, 0.7.0, and earlier) allows a local unprivileged attacker to exhaust system resources and crash the application. No user interaction is required, and the attack vector is local with no privilege prerequisites per the CVSS:3.1 vector. With an EPSS of 0.01% and SSVC exploitation status of none, this is currently a low-priority operational concern despite the high availability impact rating, though the SSVC automatable classification suggests the condition could be triggered programmatically once local access is available.

Technical ContextAI

The affected product is the Adobe Content Authenticity Initiative (CAI) Content Credentials SDK, identified by CPE cpe:2.3:a:adobe:cai_content_credentials. This SDK is used to embed, read, and verify content provenance metadata (Content Credentials) in digital assets. The root cause is CWE-400 (Uncontrolled Resource Consumption): the application fails to enforce appropriate limits on memory, CPU, or I/O when processing certain inputs or operations, allowing a local actor to drive resource exhaustion. The local attack vector (AV:L) indicates this is triggered through the host OS, likely via crafted input files or API calls made directly against the SDK on the local system, rather than over a network protocol.

RemediationAI

The primary remediation is to upgrade to a fixed version of Adobe CAI Content Credentials as specified in Adobe security advisory APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html. An exact patched version number was not independently extractable from the available intelligence data; consult the advisory directly to confirm the target upgrade version. Patch availability is confirmed per vendor advisory. If an immediate upgrade is not feasible in automated pipeline environments, consider rate-limiting or resource-capping the process executing the SDK (e.g., via OS-level cgroups memory/CPU limits or container resource constraints) to bound the blast radius of a DoS trigger. Additionally, restrict local access to the system or container where the SDK runs to authorized pipeline users only, since exploitation requires local access (AV:L). No workaround eliminates the underlying vulnerability; patching remains the only definitive fix.