What is the CVSS score of EUVD-2026-84770?

EUVD-2026-84770 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate EUVD-2026-84770?

Within 24 hours, inventory all applications and services using the c2pa-rs library or the associated CAI command-line tool, and restrict their input sources to trusted files or networks; enable detailed monitoring for CPU and memory spikes. Within 7 days, implement resource quotas (e.g., cgroups, process limits) on affected services, enforce strict input validation and size limits for C2PA manifests, and isolate parsing operations in sandboxed environments. Within 30 days, engage Adobe and the CAI community for patch status, evaluate alternative content credential libraries, and develop a rollback or failover plan; continue monitoring vendor advisories for the release of a patched version.

Adobe Content Credentials EUVD-2026-84770

| CVE-2026-75632 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-09-22 adobe

GHSA-c99f-hrqh-3cpm

Denial Of Service Adobe Rust Content Credentials Rust Sdk Content Credentials Command Line Tool

7.5

CVSS 3.1 · Vendor: adobe

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach C2PA-processing endpoint
Delivery

Submit crafted Content Credentials asset
Exploit

Trigger uncontrolled resource consumption (CWE-400)
Execution

Exhaust CPU/memory
Impact

Application denial-of-service

Vulnerability Assessment

Weakness	CWE CWE-400 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V2 - Validation and Business Logic Resource consumption limits MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the affected Adobe Content Credentials Rust SDK (c2pa-rs) or command-line tool be used to parse/validate an attacker-supplied C2PA asset or manifest; the crafted input drives uncontrolled resource consumption. No authentication or user interaction is needed (PR:N/UI:N). The practical limiting factor is exposure: network-reachable exploitation (AV:N) applies only when the SDK is embedded in a service that accepts untrusted content credential files, whereas standalone command-line usage limits the vector to locally/pipeline-supplied assets. Impact is confined to availability - no confidentiality or integrity effect.
Impact	The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes an unauthenticated, low-complexity, network-reachable denial-of-service with no confidentiality or integrity impact - availability-only. All severity in this score derives from A:H; there is no code-execution or data-exposure facet. Signals that would raise real-world priority are absent from the input: no EPSS probability, no CISA KEV listing, and no POC reference are provided, so exploitation status is 'no public exploit identified at time of analysis.' The AV:N/PR:N framing is realistic only when the affected Rust SDK (c2pa-rs) or command-line tool (c2patool) is embedded in a service that ingests attacker-controlled media/manifest files over the network; for the standalone command-line tool the practical vector is closer to local/pipeline processing of an untrusted asset. Net: this is a genuine but bounded availability issue - a real fix-forward item for anyone running the SDK in an exposed asset-processing pipeline, not a high-urgency RCE. No conflicting signals in the CVSS itself; the main caveat is that network exposure is deployment-dependent and cannot be confirmed from the sparse advisory.
Exploit ScenarioDerived	An attacker submits a maliciously crafted Content Credentials (C2PA) asset or manifest to a service that parses it using the affected Adobe Content Credentials Rust SDK or command-line tool. Processing the crafted input triggers uncontrolled resource consumption (CPU/memory), exhausting system resources and rendering the application unresponsive. No authentication or user interaction is required; no public exploit code is identified at time of analysis.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 22, 2026

Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.

RemediationAI

Apply the fixed build identified in Adobe security bulletin APSB26-147 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-147.html), which is the vendor's authoritative source for affected and patched versions; the specific fixed version number is not provided in the available intelligence, and patch status is therefore 'no vendor-released patch identified at time of analysis' from the supplied data alone. Until the upgrade is deployed, constrain the attack path, which exists only when untrusted C2PA assets reach the parser: run SDK validation out-of-process in a sandboxed worker with hard CPU, memory, and wall-clock limits plus automatic restart, and enforce pre-parse caps on input file size and manifest nesting depth. Trade-off: aggressive limits can reject legitimately large or complex Content Credentials, so tune against a representative corpus. If the CLI is used, restrict it to trusted pipeline-supplied assets and never invoke it directly on user uploads. For services embedding c2pa-rs, restrict network reachability of the validation endpoint to trusted clients or rate-limit it per source; this reduces exposure before patching but can break legitimate external content flows. Disabling C2PA validation entirely is an effective last-resort mitigation but removes provenance verification, so it should be considered only where the availability impact outweighs the loss of content authenticity checks.

Affected VersionsENISA

Content Credentials Rust SDK 0 ≤c2pa-v0.89.2

Content Credentials Command-Line Tool 0 ≤c2patool-v0.26.70

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected components are Adobe's implementation of the C2PA (Coalition for Content Provenance and Authenticity) Content Credentials specification: the Rust SDK published as c2pa-rs and the companion command-line tool, both enumerated in the CPE data (cpe:2.3:a:adobe:content_credentials_rust_sdk and cpe:2.3:a:adobe:content_credentials_command-line_tool). Validating a Content Credential requires parsing a container of CBOR/JUMBF structures - the claim, assertions, embedded ingredient files, thumbnails, and hash/signature material - whose sizes and nesting are largely declared by the file itself. CWE-400 (Uncontrolled Resource Consumption) indicates that this parsing/validation path fails to bound one or more of those attacker-influenced parameters, so a crafted manifest can drive excessive memory or CPU consumption, deep recursion, or repeated work until the process or host becomes unresponsive. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with scope unchanged, the vulnerable parsing logic is reachable without credentials and without any victim action wherever the SDK sits behind a network interface; Adobe's advisory for the Content Authenticity SDK (APSB26-147) covers this SDK family, which is also consumed indirectly by applications that embed c2pa-rs for provenance verification.

Know when Content Credentials Rust Sdk gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (adobe) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 7.5 HIGH

Unauthenticated parsing of attacker-supplied C2PA input causes resource exhaustion; availability-only (A:H, C/I:N), network vector assumes SDK embedded in an exposed service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

DescriptionCVE.org

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Executive ViewAI

Why It Matters

Adobe Content Credentials (CAI Rust SDK) contains a high-severity denial-of-service vulnerability that can exhaust system resources when parsing untrusted C2PA assets. An unauthenticated remote attacker could disrupt services that embed the SDK and ingest external content credentials, impacting availability of content authenticity verification. No vendor-released patch identified at time of analysis, so leadership should prioritize exposure reduction and interim mitigations.

Business Impact: High

Compensating Controls

No vendor patch available. Interim mitigations include: limit resource consumption (CPU, memory) for processes parsing C2PA assets; validate and sanitize all externally supplied C2PA files; restrict network reachability of vulnerable services; monitor for abnormal resource usage; and consider disabling C2PA parsing if not business-critical.

Threat Intelligence Overview

EPSS Score

0.9%

Top 42% exploitable

Prevalence

Low

Developer-facing C2PA provenance SDK/CLI; growing adoption but niche footprint

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.9%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.