Adobe Content Credentials EUVD-2026-84766

Exploitation requires the CAI Content Credentials Rust SDK or command-line tool to parse a maliciously crafted asset containing manipulated C2PA/Content Credentials metadata that triggers an integer overflow. It is gated by user interaction (UI:R): a victim must visit a maliciously crafted URL or interact with a compromised web page that delivers the crafted asset to a vulnerable application. Limiting factors: impact is confined to a denial-of-service crash (no code execution, no data exposure), the CVSS vector marks it as a local attack vector (AV:L) requiring the asset to be processed by a locally-running consumer of the SDK/CLI, and exploitation is only meaningful against applications actually built on or invoking this library.

This is a genuine but low-priority issue. The CVSS 3.1 base score is 5.5 (MEDIUM) driven entirely by availability (A:H) with no confidentiality or integrity impact (C:N/I:N) - the vector is AV:L/AC:L/PR:N/UI:R/S:U, meaning local attack vector, low complexity, no privileges, but requiring user interaction. There is no EPSS score, no CISA KEV listing, and no public POC provided in the input, so exploitation status is 'no public exploit identified at time of analysis.' The impact ceiling is a crashed application (denial-of-service), not code execution or data disclosure, which caps real-world severity regardless of how easy the trigger is. NOTE A CONFLICT: the CVSS vector specifies AV:L (local) yet the description says exploitation occurs when 'a victim must visit a maliciously crafted URL or interact with a compromised web page,' which reads like a network-delivery scenario - this is the standard Adobe framing for a locally-processed malicious asset (the SDK/tool parses attacker-supplied content that arrives via the web), so AV:L is defensible as the parsing happens locally, but defenders should verify the delivery path with the vendor. Overall this is a high-CVSS-relative-to-real-risk case: a DoS in a niche developer library, no active exploitation, no privilege escalation.

An attacker crafts a malicious media asset containing manipulated Content Credentials (C2PA) metadata that triggers an integer overflow during parsing. A victim using an application built on the CAI Content Credentials Rust SDK or the command-line tool opens or is served this asset (e.g., via a crafted URL or compromised web page), causing the integer wraparound and crashing the application. No public POC is identified at time of analysis, and the impact is limited to denial-of-service.