C2Pa EUVD-2026-44524

Adobe Content Authenticity tooling (c2pa Rust SDK ≤0.84.0, @contentauth/c2pa-web JS SDK ≤0.7.0, c2patool CLI ≤0.16.5) contains a high-severity arbitrary code execution vulnerability through untrusted library loading. While exploitation probability is currently low (0.1% EPSS) with no public exploit identified, any organization using these SDKs for content verification or authentication workflows faces supply chain risk if an attacker delivers a malicious message or URL to a system running vulnerable versions.

Within 24 hours, inventory all systems and dependencies using the affected Adobe Content Authenticity SDK versions (Rust ≤0.84.0, JavaScript ≤0.7.0, CLI ≤0.16.5) and classify by production exposure. Within 7 days, implement compensating controls including restriction of affected tool execution to sandboxed or offline environments, strict input validation for external URLs and content sources, and enhanced monitoring for suspicious process execution or library loading attempts originating from these SDKs. Within 30 days, establish automated patch deployment procedures and monitor Adobe's security advisories for patched versions; prepare a rollout plan for immediate update upon vendor release.

No vendor-released patch identified at time of analysis. Interim mitigations: restrict affected SDK versions to offline or isolated execution environments if possible; implement strict allowlisting of trusted content sources and URLs to limit malicious payload delivery vectors; enforce least-privilege execution contexts for processes running these tools; increase logging and alerting on library load operations; consider disabling non-essential content authentication features until patch availability; prepare rollback or alternative tooling as contingency should compromise be detected.