Content Credentials Rust Sdk
Monthly
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.