Content Credentials Command Line Tool
Monthly
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.