What is the CVSS score of EUVD-2026-35849?

EUVD-2026-35849 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of CAI Content Credentials are affected by EUVD-2026-35849?

Organizations using Adobe's Content Credentials SDK (c2pa-web 0.7.1, c2pa ≤0.80.1) face application outage risk due to a denial-of-service vulnerability accessible to any network-connected attacker…

How to fix or mitigate EUVD-2026-35849?

Within 24 hours: Identify all systems and applications using c2pa-web ≤0.7.1 or c2pa ≤0.80.1; assess exposure by reviewing network access and input sources. Within 7 days: Implement input validation hardening and rate-limiting on endpoints accepting content credentials; consider network-level protections if architecture permits. Within 30 days: Monitor Adobe security advisories for patch release; evaluate upgrade path to patched versions once available.

CAI Content Credentials EUVD-2026-35849

| CVE-2026-34712 HIGH

Improper Input Validation (CWE-20)

2026-06-09 adobe

GHSA-jxcp-8jh9-825w

Denial Of Service Cai Content Credentials

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 22:21 vuln.today

DescriptionNVD

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Improper Input Validation vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe's CAI Content Credentials SDK (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by submitting malformed input that bypasses validation. The flaw carries a CVSS 7.5 rating driven entirely by availability impact, with no confidentiality or integrity consequences. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

CAI (Content Authenticity Initiative) Content Credentials is Adobe's implementation of the C2PA (Coalition for Content Provenance and Authenticity) open standard, which cryptographically binds provenance metadata (creator, edits, AI involvement) to media assets. The affected components are the c2pa-web JavaScript/WASM binding (0.7.1) and the underlying c2pa Rust SDK (0.80.1 and earlier), both of which parse and validate C2PA manifests embedded in images, video, and audio files. The root cause is CWE-20 (Improper Input Validation), meaning the parser does not adequately sanity-check structural or length fields in untrusted manifest data before processing, allowing a malformed asset to trigger an unhandled error path that terminates the host process.

RemediationAI

Patch available per vendor advisory - consult Adobe Security Bulletin APSB26-61 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html for the fixed releases of c2pa-web (post-0.7.1) and the c2pa SDK (post-0.80.1), and upgrade all embedded copies including transitive dependencies in build pipelines. Where immediate upgrade is not possible, compensating controls include running the C2PA parser in an isolated worker process or sandboxed container so that a crash recycles a worker rather than the whole service (trade-off: added latency and operational complexity), enforcing strict file-size and MIME-type limits before invoking the parser on uploaded media (trade-off: legitimate large or unusual but valid assets may be rejected), and rate-limiting or authenticating the upload endpoint to prevent an unauthenticated attacker from repeatedly triggering crashes (trade-off: changes the threat surface but does not fix the underlying parser bug).