C2Patool
Monthly
Improper input validation in Adobe's Content Credentials ecosystem (Rust SDK, JS SDK, and CLI tool) allows local attackers to bypass C2PA content authenticity security controls and gain unauthorized limited write access to credential metadata. Affected are c2pa-v0.90.5 and earlier, @contentauth/c2pa-web@0.12.0 and earlier, and c2patool-v0.27.5 and earlier. No user interaction is required, but the local attack vector (AV:L) and SSVC automation rating of 'no' constrain realistic exploitation to targeted scenarios rather than mass exploitation.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - covering the Rust SDK (c2pa), JavaScript SDK (@contentauth/c2pa-web), and CLI tool (c2patool) - allows a local attacker to crash any application that processes a specially crafted content credential payload, producing a denial-of-service condition. All three components share the underlying parsing logic and are affected up to their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the availability of patched versions and a vendor advisory (APSB26-111) confirms vendor-acknowledged impact.
Path traversal in Adobe's CAI Content Credentials ecosystem - spanning the Rust SDK (c2pa-v0.90.5 and earlier), the JavaScript/Web SDK (@contentauth/c2pa-web@0.12.0 and earlier), and the c2patool command-line utility (v0.27.5 and earlier) - enables arbitrary file system reads outside the intended access scope. The flaw is triggered when a victim processes a maliciously crafted file or visits a compromised web page that causes the SDK to resolve attacker-controlled path sequences. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; patched releases exist for all three components.
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to crash the application, producing a denial-of-service condition. All three components - the Rust c2pa crate, the JS c2pa-web package, and the c2patool command-line utility - share the same CWE-190 root cause and are affected up to their respective boundary versions. No public exploit code or active exploitation has been identified; Adobe has released patched versions for all three components per advisory APSB26-111.
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allows a local attacker to trigger application denial-of-service by supplying crafted input that exhausts system resources. Three distinct release artifacts are affected: the c2patool command-line utility, the c2pa Rust crate, and the @contentauth/c2pa-web JavaScript SDK, all patched in a coordinated Adobe PSIRT disclosure (APSB26-111). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable attack conditions.
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript/WASM SDK - enables arbitrary file-system reads outside intended directory boundaries on the local host. Affected versions include c2patool ≤ v0.27.5, c2pa-rs ≤ v0.90.5, and @contentauth/c2pa-web ≤ 0.12.0, with patched releases available for all three. No public exploit has been identified at time of analysis, but the scope-changed flag in the CVSS vector indicates that successful exploitation can reach resources beyond the vulnerable component's own security domain.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exhaust system resources and cause an application denial-of-service. Three distinct SDK components are affected: the Rust SDK (c2pa), the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and the command-line tool (c2patool), all across their respective versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable without authentication or user interaction.
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.
Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is highest in automated media ingestion pipelines that validate C2PA provenance on user-supplied files.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - spanning the c2patool CLI (≤v0.27.5), Rust SDK c2pa (≤v0.90.5), and JavaScript SDK @contentauth/c2pa-web (≤v0.12.0) - allows a local attacker without elevated privileges to exhaust system resources and cause an application denial-of-service. The vulnerability does not require user interaction, lowering the bar for exploitation in automated pipelines. Adobe has released patches across all three components via advisory APSB26-111, and no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.
Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.
Arbitrary file system read in Adobe's Content Credentials ecosystem (C2PA Rust SDK, JS SDK, and c2patool CLI) allows an attacker who crafts a malicious C2PA-signed file to access files and directories outside the intended scope when a victim opens that file. The root cause is improper input validation (CWE-20), likely path traversal in manifest or asset reference parsing. No public exploit code exists at time of analysis, EPSS is 0.15% (5th percentile), and CISA SSVC rates exploitation as none - real-world risk is currently contained but the confidentiality impact is rated High given successful arbitrary file read.
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), and CLI tool (≤0.16.5) - allows unauthorized write access to content provenance data through improper input validation (CWE-20). No active exploitation is confirmed: SSVC rates exploitation as none, the vulnerability is absent from CISA KEV, and EPSS sits at 0.16% (6th percentile), signaling low real-world threat pressure at this time. Adobe has released patches across all three components under advisory APSB26-80.
Improper input validation in Adobe's Content Credentials suite (C2PA Rust SDK, JS SDK, and c2patool CLI) allows a local attacker without privileges to crash the application by supplying malformed C2PA manifest content, resulting in a denial-of-service condition. Affected components span the Rust library (c2pa ≤ 0.84.0), the Node.js web SDK (@contentauth/c2pa-web ≤ 0.7.0), and the command-line tool (c2patool ≤ v0.16.5). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable attack paths.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa), JavaScript/Node.js SDK (c2pa-web), and c2patool command-line utility - crashes the application when processing a maliciously crafted C2PA manifest or media file, resulting in a denial-of-service condition. All three components share the same vulnerable code path, broadening the attack surface across toolchains. No public exploit has been identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm this is not currently being targeted.
Integer underflow in Adobe's C2PA Content Credentials SDKs (Rust, JavaScript/Node.js, and CLI tool) allows an attacker to crash the host application by supplying a maliciously crafted C2PA manifest, resulting in a denial-of-service condition. All three release tracks are affected - the Rust SDK (≤0.84.0), the JS SDK (≤0.7.0), and c2patool (≤0.16.5) - with vendor-released patches available for each. No public exploit code has been identified at time of analysis, and EPSS sits at the 5th percentile, consistent with SSVC's 'exploitation: none' assessment.
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK (c2pa-web), and the c2patool CLI - can escalate to arbitrary code execution in the context of the current user. When an application built on these libraries validates a maliciously crafted asset or URL, the SSRF is chained into script injection to hijack the victim's session or account. No public exploit has been identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0), the @contentauth/c2pa-web JS SDK (≤0.7.0), and the c2patool CLI (≤0.16.5) — arises from an untrusted search path (CWE-426) that loads attacker-controlled libraries and runs code as the current user. Adobe PSIRT reports the flaw requires victim interaction (visiting a crafted URL or interacting with a compromised page) and a local attack vector, and there is no public exploit identified at time of analysis. EPSS is low (0.14%, 4th percentile) and CISA SSVC records exploitation as 'none', consistent with a not-yet-exploited but total-technical-impact issue.
Improper input validation in Adobe's Content Credentials ecosystem (Rust SDK, JS SDK, and CLI tool) allows local attackers to bypass C2PA content authenticity security controls and gain unauthorized limited write access to credential metadata. Affected are c2pa-v0.90.5 and earlier, @contentauth/c2pa-web@0.12.0 and earlier, and c2patool-v0.27.5 and earlier. No user interaction is required, but the local attack vector (AV:L) and SSVC automation rating of 'no' constrain realistic exploitation to targeted scenarios rather than mass exploitation.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - covering the Rust SDK (c2pa), JavaScript SDK (@contentauth/c2pa-web), and CLI tool (c2patool) - allows a local attacker to crash any application that processes a specially crafted content credential payload, producing a denial-of-service condition. All three components share the underlying parsing logic and are affected up to their respective patch releases. No public exploit or CISA KEV listing has been identified at time of analysis, but the availability of patched versions and a vendor advisory (APSB26-111) confirms vendor-acknowledged impact.
Path traversal in Adobe's CAI Content Credentials ecosystem - spanning the Rust SDK (c2pa-v0.90.5 and earlier), the JavaScript/Web SDK (@contentauth/c2pa-web@0.12.0 and earlier), and the c2patool command-line utility (v0.27.5 and earlier) - enables arbitrary file system reads outside the intended access scope. The flaw is triggered when a victim processes a maliciously crafted file or visits a compromised web page that causes the SDK to resolve attacker-controlled path sequences. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; patched releases exist for all three components.
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to crash the application, producing a denial-of-service condition. All three components - the Rust c2pa crate, the JS c2pa-web package, and the c2patool command-line utility - share the same CWE-190 root cause and are affected up to their respective boundary versions. No public exploit code or active exploitation has been identified; Adobe has released patched versions for all three components per advisory APSB26-111.
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@contentauth/c2pa-web ≤ 0.12.0), and the c2patool CLI (≤ v0.27.5) - allows denial-of-service through application crash when processing maliciously crafted C2PA assets. The CVSS:3.1/AV:L vector indicates the exploitable surface is file or data ingestion rather than a directly exposed network service, requiring no user interaction or privileges once a crafted asset reaches the parsing pipeline. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allows a local attacker to trigger application denial-of-service by supplying crafted input that exhausts system resources. Three distinct release artifacts are affected: the c2patool command-line utility, the c2pa Rust crate, and the @contentauth/c2pa-web JavaScript SDK, all patched in a coordinated Adobe PSIRT disclosure (APSB26-111). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable attack conditions.
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentauth/c2pa-web JavaScript/WASM SDK - enables arbitrary file-system reads outside intended directory boundaries on the local host. Affected versions include c2patool ≤ v0.27.5, c2pa-rs ≤ v0.90.5, and @contentauth/c2pa-web ≤ 0.12.0, with patched releases available for all three. No public exploit has been identified at time of analysis, but the scope-changed flag in the CVSS vector indicates that successful exploitation can reach resources beyond the vulnerable component's own security domain.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exhaust system resources and cause an application denial-of-service. Three distinct SDK components are affected: the Rust SDK (c2pa), the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and the command-line tool (c2patool), all across their respective versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable without authentication or user interaction.
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12.1, CLI tool ≤c2patool-v0.27.5) enables unauthenticated remote attackers to crash any application built on these libraries by supplying a crafted C2PA media payload. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward remote exploitation with zero prerequisites or user involvement. No active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis; vendor-released patches are available for all three SDK components.
Certificate validation bypass in Adobe's Content Credentials SDK undermines the C2PA provenance chain across three SDK variants - JavaScript/WASM (@contentauth/c2pa-web through 0.12.0), Rust (c2pa through v0.90.5), and CLI (c2patool through v0.27.5) - allowing an attacker-controlled certificate to be accepted as legitimate when a victim visits a malicious URL or interacts with a compromised web page. Successful exploitation grants unauthorized write access to content credentials, enabling an attacker to forge provenance metadata and defeat the product's core integrity guarantee. No public exploit has been identified at time of analysis; vendor-released patches exist for all three affected SDK variants.
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote unauthenticated attacker to bypass integrity verification and gain unauthorized write access to C2PA-signed content metadata. All three SDK components prior to their respective patch releases are affected, and exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page. No public exploit code or active exploitation has been identified at time of analysis, though the write-impact on content authenticity signals carries meaningful trust implications for downstream consumers.
Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is highest in automated media ingestion pipelines that validate C2PA provenance on user-supplied files.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - spanning the c2patool CLI (≤v0.27.5), Rust SDK c2pa (≤v0.90.5), and JavaScript SDK @contentauth/c2pa-web (≤v0.12.0) - allows a local attacker without elevated privileges to exhaust system resources and cause an application denial-of-service. The vulnerability does not require user interaction, lowering the bar for exploitation in automated pipelines. Adobe has released patches across all three components via advisory APSB26-111, and no public exploit code or active exploitation has been identified at time of analysis.
Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.
SSRF with privilege escalation affects Adobe's Content Credentials SDK and CLI toolchain, enabling a network-based attacker to induce the victim's client to issue server-side requests to unintended internal or external targets. Exploitation requires user interaction - a victim must visit a crafted URL or engage with a compromised web page - but the CVSS scope change (S:C) indicates the vulnerability can reach beyond the directly vulnerable component to affect other systems or services. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.
Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.
Arbitrary file system read in Adobe's Content Credentials ecosystem (C2PA Rust SDK, JS SDK, and c2patool CLI) allows an attacker who crafts a malicious C2PA-signed file to access files and directories outside the intended scope when a victim opens that file. The root cause is improper input validation (CWE-20), likely path traversal in manifest or asset reference parsing. No public exploit code exists at time of analysis, EPSS is 0.15% (5th percentile), and CISA SSVC rates exploitation as none - real-world risk is currently contained but the confidentiality impact is rated High given successful arbitrary file read.
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), and CLI tool (≤0.16.5) - allows unauthorized write access to content provenance data through improper input validation (CWE-20). No active exploitation is confirmed: SSVC rates exploitation as none, the vulnerability is absent from CISA KEV, and EPSS sits at 0.16% (6th percentile), signaling low real-world threat pressure at this time. Adobe has released patches across all three components under advisory APSB26-80.
Improper input validation in Adobe's Content Credentials suite (C2PA Rust SDK, JS SDK, and c2patool CLI) allows a local attacker without privileges to crash the application by supplying malformed C2PA manifest content, resulting in a denial-of-service condition. Affected components span the Rust library (c2pa ≤ 0.84.0), the Node.js web SDK (@contentauth/c2pa-web ≤ 0.7.0), and the command-line tool (c2patool ≤ v0.16.5). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable attack paths.
Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa), JavaScript/Node.js SDK (c2pa-web), and c2patool command-line utility - crashes the application when processing a maliciously crafted C2PA manifest or media file, resulting in a denial-of-service condition. All three components share the same vulnerable code path, broadening the attack surface across toolchains. No public exploit has been identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm this is not currently being targeted.
Integer underflow in Adobe's C2PA Content Credentials SDKs (Rust, JavaScript/Node.js, and CLI tool) allows an attacker to crash the host application by supplying a maliciously crafted C2PA manifest, resulting in a denial-of-service condition. All three release tracks are affected - the Rust SDK (≤0.84.0), the JS SDK (≤0.7.0), and c2patool (≤0.16.5) - with vendor-released patches available for each. No public exploit code has been identified at time of analysis, and EPSS sits at the 5th percentile, consistent with SSVC's 'exploitation: none' assessment.
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS SDK (@contentauth/c2pa-web ≤0.7.0), and the c2patool command-line utility (≤0.16.5) - allows a remote attacker to gain unauthorized read access to sensitive credentials due to insufficient protection of stored secrets (CWE-522). The CVSS 3.1 vector (AV:N/PR:N/UI:N, C:H) rates it 7.5 High with no authentication or user interaction required. There is no public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and EPSS is low at 0.39% (31st percentile), so no active exploitation is evidenced.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK (c2pa-web), and the c2patool CLI - can escalate to arbitrary code execution in the context of the current user. When an application built on these libraries validates a maliciously crafted asset or URL, the SSRF is chained into script injection to hijack the victim's session or account. No public exploit has been identified at time of analysis, and the EPSS score is low (0.18%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0), the @contentauth/c2pa-web JS SDK (≤0.7.0), and the c2patool CLI (≤0.16.5) — arises from an untrusted search path (CWE-426) that loads attacker-controlled libraries and runs code as the current user. Adobe PSIRT reports the flaw requires victim interaction (visiting a crafted URL or interacting with a compromised page) and a local attack vector, and there is no public exploit identified at time of analysis. EPSS is low (0.14%, 4th percentile) and CISA SSVC records exploitation as 'none', consistent with a not-yet-exploited but total-technical-impact issue.