What is the CVSS score of EUVD-2026-35850?

EUVD-2026-35850 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of CAI Content Credentials are affected by EUVD-2026-35850?

Adobe Content Authenticity Initiative libraries (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) contain an unauthenticated denial-of-service vulnerability allowing any remote attacker to crash…

How to fix or mitigate EUVD-2026-35850?

Within 24 hours: Audit all internal and external systems for dependencies on c2pa-web and c2pa versions 0.80.1 and earlier. Within 7 days: Implement input size validation and rate limiting on content credential processing endpoints; restrict network access if operationally feasible. Within 30 days: Establish vendor patch monitoring; prepare immediate upgrade procedures for cpa-web and c2pa versions when patches are released; evaluate architectural alternatives if patches remain unavailable.

CAI Content Credentials EUVD-2026-35850

| CVE-2026-34711 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-06-09 adobe

GHSA-47r4-q5f4-x2qv

Denial Of Service Integer Overflow Cai Content Credentials

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 22:22 vuln.today

CVE Published

Jun 09, 2026 - 21:21 nvd

HIGH 7.5

DescriptionNVD

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe CAI Content Credentials (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by triggering an integer overflow during C2PA content processing. With a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N) and no public exploit identified at time of analysis, the bug carries pure availability impact - no data exposure or code execution - but is trivially reachable by anyone who can feed input to the library.

Technical ContextAI

The Content Authenticity Initiative (CAI) Content Credentials stack - Adobe's reference implementation of the C2PA (Coalition for Content Provenance and Authenticity) specification used to bind cryptographic provenance manifests to media - ships as the c2pa Rust crate and the c2pa-web JavaScript/WASM wrapper. CWE-190 (Integer Overflow or Wraparound) at this layer typically arises when a length, offset, or count field parsed from a C2PA manifest, JUMBF box, or embedded asset is multiplied or added without bounds checking, wrapping a size_t/usize value and producing an out-of-bounds read, undersized allocation, or assertion failure that aborts the host process. The affected CPE is cpe:2.3:a:adobe:cai_content_credentials:*:*:*:*:*:*:*:* covering c2pa-web@0.7.1 and the underlying c2pa@0.80.1 and earlier.

RemediationAI

Patch available per vendor advisory APSB26-61 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html); upgrade c2pa-web past 0.7.1 and the c2pa crate past 0.80.1 to the fixed releases listed there, and rebuild any application that bundles them since a host-side dependency bump alone will not propagate into shipped binaries or WASM bundles. If immediate upgrade is not possible, gate C2PA parsing behind a size/type pre-filter that rejects oversized or malformed manifests before they reach the library, run the parser in an isolated worker or subprocess so a crash only kills that worker rather than the whole service, and rate-limit verification endpoints to blunt automated crash loops - trade-offs are added latency, reduced concurrency, and the possibility of false-rejecting legitimate but unusually large manifests.