EUVD-2026-56274
GHSA-48jq-gxp5-36cw
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector reflects file-ingestion exploitation path; PR:N because supplying a crafted asset requires no system privilege; availability-only impact matches reliable crash with no data or integrity exposure.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Technical ContextAI
The affected components implement the C2PA (Coalition for Content Provenance and Authenticity) open standard for digital content provenance, maintained under the Content Authenticity Initiative (CAI). Three distinct SDK packages share the same underlying flaw: the Rust crate c2pa (pkg:cargo/c2pa@<=0.90.5), the JavaScript/WebAssembly package @contentauth/c2pa-web (pkg:npm/@contentauth/c2pa-web@<=0.12.0), and the c2patool CLI binary (c2patool-v0.27.5). CWE-190 (Integer Overflow or Wraparound) identifies the root cause class: arithmetic on size, length, or offset values during C2PA manifest parsing overflows the integer type's representable range, producing an incorrect - often very large or negative - value subsequently used for memory allocation or array indexing, culminating in an unhandled crash. This class of defect is a well-known risk in binary format parsers, and the presence of the same bug across Rust, JS, and CLI artifacts suggests a shared parsing routine or common logic.
RemediationAI
Upgrade to the vendor-released patched versions: Rust SDK c2pa-v0.90.6, JS SDK @contentauth/c2pa-web@0.12.1, and CLI c2patool-v0.27.6, as confirmed in Adobe advisory APSB26-111 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html). If immediate patching is not feasible, restrict the application so that only internally generated or cryptographically trusted C2PA assets are submitted to the SDK's parsing routines - this eliminates the attacker's ability to supply a crafted payload and effectively neutralizes exploitation. Where ingestion of external assets cannot be avoided, consider running the SDK in an isolated process or container so that a crash does not propagate to the broader application stack; this contains the blast radius but does not prevent the crash itself and adds operational overhead. Pre-validation of incoming file size and basic structural sanity at the ingestion boundary can reduce - but not eliminate - exposure.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allo
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today