Content Credentials SDK EUVD-2026-65623

Exploitation requires local access to a system running Adobe's c2pa_tool or content_credentials_rust_sdk and the ability to supply a specially crafted C2PA manifest file to the processing pipeline. The CVSS vector (AV:L/PR:N/UI:N) confirms no elevated privileges and no user interaction are required once the malicious file reaches the tool. Exploitation is strictly bounded to denial-of-service (application crash); no code execution, data exfiltration, or integrity impact has been identified. Remote, unauthenticated network exploitation is not indicated by available data. The primary limiting factor is the local attack vector - an adversary without the ability to place or deliver a crafted file to the local processing pipeline cannot exploit this vulnerability.

The CVSS 6.2 score reflects a moderate-severity, local-only vulnerability. The AV:L vector substantially restricts the realistic attack surface: exploitation requires that a crafted file reaches a system running the c2pa_tool or Rust SDK locally, which limits exposure compared to network-accessible flaws. AC:L and PR:N indicate the underflow is straightforward to trigger once file delivery is achieved, requiring no elevated privileges. The impact is confined exclusively to availability (A:H, C:N, I:N), meaning the worst reachable outcome is an application crash with no data exposure or code execution path identified. No CISA KEV listing is present and no public proof-of-concept has been identified, so active or widespread exploitation is not confirmed. EPSS data was absent from available intelligence. Real-world priority is highest for organizations running automated C2PA content validation pipelines that ingest untrusted media - a disrupted validation workflow could have downstream consequences for content authenticity workflows - but for typical interactive deployments the crash risk is self-contained.

An attacker crafts a media file embedding a C2PA manifest with a malformed integer field engineered to underflow the SDK's size or offset computation during parsing. When this file is supplied to a content authenticity pipeline or operator invoking the c2pa_tool or Rust SDK locally, the underflow causes the application to crash, interrupting the content verification workflow. No public proof-of-concept has been identified, and the local-only vector means the attacker must be able to deliver the crafted file to the processing environment.