Cai Content Credentials
Monthly
Denial-of-service in Adobe CAI Content Credentials (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by triggering an integer overflow during C2PA content processing. With a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N) and no public exploit identified at time of analysis, the bug carries pure availability impact - no data exposure or code execution - but is trivially reachable by anyone who can feed input to the library.
Denial-of-service in Adobe's CAI Content Credentials SDK (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by submitting malformed input that bypasses validation. The flaw carries a CVSS 7.5 rating driven entirely by availability impact, with no confidentiality or integrity consequences. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Denial-of-service in Adobe CAI Content Credentials (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to exhaust system resources and crash the application by triggering uncontrolled resource consumption during C2PA content processing. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 7.5 score reflects easy network-based exploitation with no user interaction required. Affected deployments are those embedding Adobe's Content Authenticity SDK for verifying or generating C2PA provenance manifests on web-facing services.
Uncontrolled resource consumption in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK versions 0.78.2, 0.7.0 and earlier lets a remote unauthenticated attacker exhaust system resources and crash the application (availability-only denial-of-service). No public exploit is identified at time of analysis and EPSS probability is negligible (0.01%), but SSVC flags the attack as automatable, so exploitation could be scripted once a vector is understood. Confidentiality and integrity are not impacted.
Uncontrolled resource consumption in Adobe CAI Content Credentials (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local attacker without privileges to exhaust system resources, resulting in a denial-of-service condition. The vulnerability requires no user interaction, meaning it can be triggered programmatically by any process with local access to a system running the affected SDK. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper input validation in Adobe's CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) permits a local attacker to crash the consuming application by supplying malformed input, resulting in a denial-of-service condition. No user interaction is required once the attacker can deliver crafted input to the locally running process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the crash-based impact and low attack complexity make it straightforward to trigger.
Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local, unprivileged attacker to exhaust system resources and trigger an application-level denial-of-service condition. The CVSS vector confirms local attack vector with no privileges required and no user interaction, meaning any local process or user context capable of invoking the SDK can trigger the condition. No public exploit code or CISA KEV listing has been identified at time of analysis, and the availability impact is rated High with no confidentiality or integrity exposure.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local, unprivileged attacker to exhaust system resources and crash the hosting application. The CVSS vector confirms local access is required, limiting exposure primarily to environments where untrusted users share process space with SDK-consuming applications, such as multi-tenant systems or services that process attacker-supplied C2PA credential data from disk or local input. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in Adobe CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) permits arbitrary file writes outside the intended extraction directory when a victim opens a maliciously crafted C2PA content credentials file. The CVSS vector confirms a local attack surface (AV:L) with high integrity impact (I:H) and no confidentiality or availability impact, meaning an attacker's primary capability is unauthorized file placement on the target filesystem. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Integer underflow in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, with version 0.78.2 also cited) allows an attacker supplying crafted credential payloads to crash the application, producing a denial-of-service condition. The vendor advisory APSB26-53 confirms no user interaction is required for exploitation, though the local attack vector (AV:L) means the malicious payload must reach the SDK through a local processing channel. EPSS sits at 0.01% and CISA SSVC reports exploitation status as none, indicating no public exploit activity at time of analysis.
Integer overflow in Adobe CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application, producing a denial-of-service condition without requiring any user interaction. The flaw is classified under CWE-190 and carries a CVSS 6.2 score with local attack vector, meaning exploitation requires the attacker to be operating in the same local environment as the affected application. No active exploitation has been identified (SSVC: Exploitation: none), and EPSS places this at the 0th percentile, indicating near-zero observed exploitation probability.
Denial-of-service in Adobe CAI Content Credentials versions 0.7.0 and earlier (and additionally 0.78.2 per the CVE description) stems from improper input validation (CWE-20) that allows a local unprivileged attacker to crash the application without requiring user interaction. The vulnerability carries a CVSS 6.2 base score with local attack vector and high availability impact, but no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS exploitation probability is 0.01%, and CISA SSVC reports exploitation status as none - placing this squarely in routine patch cycle territory.
Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker without authentication to exhaust system resources, causing application-level denial of service. Rooted in CWE-400, the SDK imposes no sufficient limits on resource consumption when processing input, with the entire impact confined to availability - no confidentiality or integrity exposure exists. No public exploit code has been identified, EPSS sits at 0.01% (0th percentile), SSVC characterizes exploitation as 'none', and the vulnerability is absent from CISA's KEV catalog, collectively indicating low real-world exploitation probability at time of analysis.
Adobe CAI Content Credentials SDK versions 0.7.0 and earlier contain an improper input validation flaw that enables a local, unprivileged attacker to crash the application and cause a denial-of-service condition without any user interaction. The local attack vector (AV:L) confines exploitation to hosts where the SDK is installed and accepting input, which materially limits the threat surface despite the SSVC Automatable:yes classification. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) confirms near-zero empirical exploitation probability.
Integer overflow in Adobe's CAI Content Credentials SDK (versions ≤0.7.0 per EUVD; version 0.78.2 also cited in NVD description) enables a local, unprivileged attacker to crash the application by supplying crafted input, producing a denial-of-service condition with no confidentiality or integrity exposure. The root cause is a CWE-190 integer wraparound flaw confined entirely to availability impact. No active exploitation has been reported: EPSS sits at the 0th percentile, CISA SSVC rates exploitation status as 'none', and no public exploit code or CISA KEV listing exists at time of analysis.
Local denial-of-service in Adobe CAI Content Credentials SDK versions 0.7.0 and earlier (including 0.78.2) allows an attacker with local access to crash the application by supplying maliciously crafted input, triggering an improper input validation flaw (CWE-20). No user interaction is required to exploit the vulnerability, though exploitation is constrained to local attack vectors per the CVSS:3.1 AV:L designation. EPSS sits at 0.01% (1st percentile) and SSVC exploitation status is confirmed 'none', indicating no public exploit or active exploitation identified at time of analysis.
Uncontrolled resource consumption in Adobe CAI Content Credentials (versions 0.78.2, 0.7.0, and earlier) allows a local unprivileged attacker to exhaust system resources and crash the application. No user interaction is required, and the attack vector is local with no privilege prerequisites per the CVSS:3.1 vector. With an EPSS of 0.01% and SSVC exploitation status of none, this is currently a low-priority operational concern despite the high availability impact rating, though the SSVC automatable classification suggests the condition could be triggered programmatically once local access is available.
Integer underflow (CWE-191) in Adobe's CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application and cause a denial-of-service condition. No user interaction is required, and the SSVC assessment classifies the vulnerability as automatable, meaning reliable exploitation can be scripted. EPSS sits at 0.01% with SSVC exploitation status of 'none', and no active exploitation or public exploit code has been identified at time of analysis - real-world risk is correspondingly low despite the 'Automatable: yes' SSVC flag.
Improper input validation in Adobe's CAI Content Credentials SDK (versions 0.78.2 and 0.7.0 and earlier) allows a local attacker to crash the application by supplying malformed content credential data, resulting in a denial-of-service condition. The flaw requires no user interaction and no special privileges beyond local access to provide input to the application. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but SSVC flags exploitation as automatable once access is achieved.
Denial-of-service via improper input validation in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application without requiring any privileges or user interaction. The root cause is CWE-20 (Improper Input Validation), meaning the SDK fails to adequately reject or sanitize malformed input before processing it. No active exploitation has been identified (SSVC: Exploitation none; EPSS: 0.01%), and impact is limited strictly to availability - there is no confidentiality or integrity exposure.
Improper input validation in Adobe CAI Content Credentials (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application, producing a denial-of-service condition without requiring user interaction. The vulnerability stems from insufficient validation of attacker-supplied input processed by the SDK, classified under CWE-20. With an EPSS of 0.01% (1st percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low, though SSVC notes the attack is automatable once local access is achieved.
Uncontrolled resource consumption in Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and earlier allows a local attacker without credentials to exhaust system resources and crash the application. The vulnerability (CWE-400) is limited to a denial-of-service impact with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the SSVC also rates the issue as automatable, suggesting that once triggered, the resource exhaustion path requires minimal attacker effort.
Denial-of-service in Adobe CAI Content Credentials (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by triggering an integer overflow during C2PA content processing. With a CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N) and no public exploit identified at time of analysis, the bug carries pure availability impact - no data exposure or code execution - but is trivially reachable by anyone who can feed input to the library.
Denial-of-service in Adobe's CAI Content Credentials SDK (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to crash the application by submitting malformed input that bypasses validation. The flaw carries a CVSS 7.5 rating driven entirely by availability impact, with no confidentiality or integrity consequences. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Denial-of-service in Adobe CAI Content Credentials (c2pa-web 0.7.1 and c2pa 0.80.1 and earlier) allows remote unauthenticated attackers to exhaust system resources and crash the application by triggering uncontrolled resource consumption during C2PA content processing. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 7.5 score reflects easy network-based exploitation with no user interaction required. Affected deployments are those embedding Adobe's Content Authenticity SDK for verifying or generating C2PA provenance manifests on web-facing services.
Uncontrolled resource consumption in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK versions 0.78.2, 0.7.0 and earlier lets a remote unauthenticated attacker exhaust system resources and crash the application (availability-only denial-of-service). No public exploit is identified at time of analysis and EPSS probability is negligible (0.01%), but SSVC flags the attack as automatable, so exploitation could be scripted once a vector is understood. Confidentiality and integrity are not impacted.
Uncontrolled resource consumption in Adobe CAI Content Credentials (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local attacker without privileges to exhaust system resources, resulting in a denial-of-service condition. The vulnerability requires no user interaction, meaning it can be triggered programmatically by any process with local access to a system running the affected SDK. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper input validation in Adobe's CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) permits a local attacker to crash the consuming application by supplying malformed input, resulting in a denial-of-service condition. No user interaction is required once the attacker can deliver crafted input to the locally running process. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the crash-based impact and low attack complexity make it straightforward to trigger.
Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local, unprivileged attacker to exhaust system resources and trigger an application-level denial-of-service condition. The CVSS vector confirms local attack vector with no privileges required and no user interaction, meaning any local process or user context capable of invoking the SDK can trigger the condition. No public exploit code or CISA KEV listing has been identified at time of analysis, and the availability impact is rated High with no confidentiality or integrity exposure.
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) allows a local, unprivileged attacker to exhaust system resources and crash the hosting application. The CVSS vector confirms local access is required, limiting exposure primarily to environments where untrusted users share process space with SDK-consuming applications, such as multi-tenant systems or services that process attacker-supplied C2PA credential data from disk or local input. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Path traversal in Adobe CAI Content Credentials SDK (c2pa-web@0.7.1 and c2pa-v0.80.1 and earlier) permits arbitrary file writes outside the intended extraction directory when a victim opens a maliciously crafted C2PA content credentials file. The CVSS vector confirms a local attack surface (AV:L) with high integrity impact (I:H) and no confidentiality or availability impact, meaning an attacker's primary capability is unauthorized file placement on the target filesystem. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Integer underflow in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, with version 0.78.2 also cited) allows an attacker supplying crafted credential payloads to crash the application, producing a denial-of-service condition. The vendor advisory APSB26-53 confirms no user interaction is required for exploitation, though the local attack vector (AV:L) means the malicious payload must reach the SDK through a local processing channel. EPSS sits at 0.01% and CISA SSVC reports exploitation status as none, indicating no public exploit activity at time of analysis.
Integer overflow in Adobe CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application, producing a denial-of-service condition without requiring any user interaction. The flaw is classified under CWE-190 and carries a CVSS 6.2 score with local attack vector, meaning exploitation requires the attacker to be operating in the same local environment as the affected application. No active exploitation has been identified (SSVC: Exploitation: none), and EPSS places this at the 0th percentile, indicating near-zero observed exploitation probability.
Denial-of-service in Adobe CAI Content Credentials versions 0.7.0 and earlier (and additionally 0.78.2 per the CVE description) stems from improper input validation (CWE-20) that allows a local unprivileged attacker to crash the application without requiring user interaction. The vulnerability carries a CVSS 6.2 base score with local attack vector and high availability impact, but no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS exploitation probability is 0.01%, and CISA SSVC reports exploitation status as none - placing this squarely in routine patch cycle territory.
Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker without authentication to exhaust system resources, causing application-level denial of service. Rooted in CWE-400, the SDK imposes no sufficient limits on resource consumption when processing input, with the entire impact confined to availability - no confidentiality or integrity exposure exists. No public exploit code has been identified, EPSS sits at 0.01% (0th percentile), SSVC characterizes exploitation as 'none', and the vulnerability is absent from CISA's KEV catalog, collectively indicating low real-world exploitation probability at time of analysis.
Adobe CAI Content Credentials SDK versions 0.7.0 and earlier contain an improper input validation flaw that enables a local, unprivileged attacker to crash the application and cause a denial-of-service condition without any user interaction. The local attack vector (AV:L) confines exploitation to hosts where the SDK is installed and accepting input, which materially limits the threat surface despite the SSVC Automatable:yes classification. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) confirms near-zero empirical exploitation probability.
Integer overflow in Adobe's CAI Content Credentials SDK (versions ≤0.7.0 per EUVD; version 0.78.2 also cited in NVD description) enables a local, unprivileged attacker to crash the application by supplying crafted input, producing a denial-of-service condition with no confidentiality or integrity exposure. The root cause is a CWE-190 integer wraparound flaw confined entirely to availability impact. No active exploitation has been reported: EPSS sits at the 0th percentile, CISA SSVC rates exploitation status as 'none', and no public exploit code or CISA KEV listing exists at time of analysis.
Local denial-of-service in Adobe CAI Content Credentials SDK versions 0.7.0 and earlier (including 0.78.2) allows an attacker with local access to crash the application by supplying maliciously crafted input, triggering an improper input validation flaw (CWE-20). No user interaction is required to exploit the vulnerability, though exploitation is constrained to local attack vectors per the CVSS:3.1 AV:L designation. EPSS sits at 0.01% (1st percentile) and SSVC exploitation status is confirmed 'none', indicating no public exploit or active exploitation identified at time of analysis.
Uncontrolled resource consumption in Adobe CAI Content Credentials (versions 0.78.2, 0.7.0, and earlier) allows a local unprivileged attacker to exhaust system resources and crash the application. No user interaction is required, and the attack vector is local with no privilege prerequisites per the CVSS:3.1 vector. With an EPSS of 0.01% and SSVC exploitation status of none, this is currently a low-priority operational concern despite the high availability impact rating, though the SSVC automatable classification suggests the condition could be triggered programmatically once local access is available.
Integer underflow (CWE-191) in Adobe's CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application and cause a denial-of-service condition. No user interaction is required, and the SSVC assessment classifies the vulnerability as automatable, meaning reliable exploitation can be scripted. EPSS sits at 0.01% with SSVC exploitation status of 'none', and no active exploitation or public exploit code has been identified at time of analysis - real-world risk is correspondingly low despite the 'Automatable: yes' SSVC flag.
Improper input validation in Adobe's CAI Content Credentials SDK (versions 0.78.2 and 0.7.0 and earlier) allows a local attacker to crash the application by supplying malformed content credential data, resulting in a denial-of-service condition. The flaw requires no user interaction and no special privileges beyond local access to provide input to the application. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but SSVC flags exploitation as automatable once access is achieved.
Denial-of-service via improper input validation in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application without requiring any privileges or user interaction. The root cause is CWE-20 (Improper Input Validation), meaning the SDK fails to adequately reject or sanitize malformed input before processing it. No active exploitation has been identified (SSVC: Exploitation none; EPSS: 0.01%), and impact is limited strictly to availability - there is no confidentiality or integrity exposure.
Improper input validation in Adobe CAI Content Credentials (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application, producing a denial-of-service condition without requiring user interaction. The vulnerability stems from insufficient validation of attacker-supplied input processed by the SDK, classified under CWE-20. With an EPSS of 0.01% (1st percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low, though SSVC notes the attack is automatable once local access is achieved.
Uncontrolled resource consumption in Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and earlier allows a local attacker without credentials to exhaust system resources and crash the application. The vulnerability (CWE-400) is limited to a denial-of-service impact with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the SSVC also rates the issue as automatable, suggesting that once triggered, the resource exhaustion path requires minimal attacker effort.