EUVD-2026-65626
GHSA-xcpm-fvj3-727h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no authentication or user interaction required; impact is availability-only DoS with no confidentiality or integrity exposure, fully consistent with vendor vector.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the ability to supply input to an application or service that calls the Adobe C2PA Tool or Content Credentials Rust SDK. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a base score of 7.5, reflecting fully unauthenticated, low-complexity, network-reachable denial-of-service with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a specially crafted C2PA manifest or media file to a web service or automated content-authenticity pipeline that uses the Adobe Content Credentials Rust SDK or C2PA Tool to validate provenance metadata. The malformed input bypasses input validation checks, triggering a panic or unhandled error condition that crashes the application or service, resulting in a denial-of-service. … |
| Remediation | Apply the patch detailed in Adobe security bulletin APSB26-110 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html; the advisory should specify exact fixed versions for both the C2PA Tool and the Content Credentials Rust SDK - the patched version was not independently confirmable from available input data and must be confirmed via the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit systems and applications embedding or invoking the affected Adobe Content Credentials SDK or C2PA Tool to establish baseline exposure and operational dependencies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Cred
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processin
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today