What is the CVSS score of EUVD-2026-29779?

EUVD-2026-29779 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

CAI Content Credentials EUVD-2026-29779

| CVE-2026-34680 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-05-12 adobe

GHSA-65f7-677m-v932

Denial Of Service Integer Overflow Adobe Cai Content Credentials

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector is consistent with SDK processing crafted input; no privileges or interaction needed; impact is crash-only with no data exposure.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:30 vuln.today

CVE Published

May 12, 2026 - 20:03 nvd

MEDIUM 6.2

DescriptionCVE.org

CAI Content Credentials versions 0.78.2, 0.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe's CAI Content Credentials SDK (versions ≤0.7.0 per EUVD; version 0.78.2 also cited in NVD description) enables a local, unprivileged attacker to crash the application by supplying crafted input, producing a denial-of-service condition with no confidentiality or integrity exposure. The root cause is a CWE-190 integer wraparound flaw confined entirely to availability impact. No active exploitation has been reported: EPSS sits at the 0th percentile, CISA SSVC rates exploitation status as 'none', and no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

CAI Content Credentials is Adobe's SDK for the Content Authenticity Initiative, used to embed and verify content provenance metadata aligned with the C2PA (Coalition for Content Provenance and Authenticity) standard. The affected CPE is cpe:2.3:a:adobe:cai_content_credentials. CWE-190 (Integer Overflow or Wraparound) occurs when an arithmetic operation produces a value outside the representable range for the data type, causing the value to wrap around unexpectedly. In this context, a crafted input likely triggers an overflow in a size or index calculation within the SDK's artifact parsing or processing logic, leading to an unhandled internal state that crashes the application. The CVSS vector (AV:L/AC:L/PR:N/UI:N) is consistent with a locally-accessible file or content artifact being processed by the SDK - no special privileges or user interaction are needed once the malformed input reaches the library.

RemediationAI

Consult the Adobe security advisory APSB26-53 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html for the exact patched release version and upgrade instructions; a specific fixed version is not independently confirmed from the available intelligence data and should not be assumed. As a compensating control pending upgrade, restrict the processing of untrusted or externally-sourced content artifacts through the CAI SDK by validating input sizes and structural boundaries before passing them to the library - this reduces the attack surface without disabling content authenticity functionality entirely. For production pipelines, consider isolating SDK calls in a sandboxed worker process so that a crash does not propagate to the parent application; note this adds latency and operational complexity. Continue monitoring the Adobe PSIRT bulletin page and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-34680 for patch confirmation and version clarification.