Content Credentials Rust Sdk
Monthly
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
Denial of service in Adobe Content Credentials - the Content Authenticity Initiative (CAI) Rust SDK (c2pa-rs) and its associated command-line tool - allows attackers to exhaust system resources when the library is used to parse or validate an attacker-supplied C2PA asset or manifest. The flaw is classified as uncontrolled resource consumption (CWE-400) with CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): authentication and user interaction are not required, and impact is availability-only with no confidentiality or integrity effect. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so real-world risk is driven mainly by exposure - a network-reachable exploit path exists only where the SDK is embedded in a service that ingests untrusted content credential files, while standalone command-line usage limits the vector to locally or pipeline-supplied assets.
Improper input validation in Adobe's Content Credentials Rust SDK and its companion command-line tool lets unauthenticated remote attackers supply a crafted asset or Content Credentials manifest that slips past the SDK's validation logic, bypassing the intended security control and allowing unauthorized write/forgery of Content Credentials provenance data. The defect is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), but the impact is integrity-only - confidentiality and availability are unaffected (C:N/I:H/A:N) - so exposure is bounded to applications and workflows that actually invoke the SDK or CLI to validate attacker-supplied content, particularly those relying on these credentials for media authenticity or trust decisions. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or KEV data was supplied; Adobe's advisory (APSB26-147) is the authoritative source.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Credentials Rust SDK - enables a remote unauthenticated attacker to crash the application and cause a denial-of-service condition. Both library and CLI components are affected per CPE strings, meaning downstream applications that embed or invoke this SDK to validate content provenance may also be disrupted. No public exploit has been identified at time of analysis, but the zero-complexity, no-authentication, no-interaction attack surface makes the vulnerability straightforwardly reachable wherever the affected component processes untrusted input.
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash affected applications, producing a denial-of-service condition. The flaw (CWE-191) is triggered without user interaction and is reachable over the network with low attack complexity, making it straightforward to exploit against any service that processes C2PA content credential data using Adobe's SDK. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the zero-prerequisite attack surface warrants prompt patching.
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
Improper input validation in Adobe Content Credentials - covering both the Content Credentials Rust SDK and the Content Credentials command-line tool - lets a remote attacker bypass security checks and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page that supplies malformed input. It carries a 4.3 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), an on-the-low-end rating driven by the required victim interaction and the integrity-only, limited impact with no confidentiality or availability loss. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the Adobe advisory cited as the reference does not state a fixed version.
Processing a maliciously crafted C2PA / Content Credentials asset through the CAI (Content Authenticity Initiative) Content Credentials Rust SDK or its companion command-line tool causes improper input validation (CWE-20) that terminates the application, resulting in an application-level denial of service. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning exploitation is unauthenticated but requires the victim to actively load attacker-supplied input - for example by opening a malformed C2PA file, visiting a crafted URL, or interacting with a compromised web page that feeds the SDK. Per the independent assessment this is a genuine but low-priority issue: only a crash is achievable (no code execution, data disclosure, or integrity modification), and no public exploit code has been identified, with the issue not listed in CISA KEV. EPSS scoring was not provided in the available intelligence.
Integer overflow in Adobe's CAI Content Credentials Rust SDK and Content Credentials command-line tool crashes applications that parse a maliciously crafted C2PA/Content Credentials asset, producing a denial-of-service condition. The flaw requires no authentication (CVSS PR:N), but exploitation is gated by user interaction (UI:R) - a victim must visit a maliciously crafted URL or interact with a compromised web page that hands the crafted asset to a vulnerable parser - and the scored impact is limited to availability loss, with no code execution or data confidentiality impact. This is a genuine but low-priority issue: no public exploit identified at time of analysis, no confirmed active exploitation, and risk is confined to applications actually built on or invoking this SDK or CLI; maintainers of downstream consumers should follow Adobe advisory apsb26-147 for fixed builds.
Improper input validation in Adobe CAI Content Credentials (the Rust SDK and the command-line tool) lets remote, unauthenticated attackers bypass integrity protections and gain unauthorized write access to Content Credentials data when a victim processes attacker-controlled content - a maliciously crafted URL or a compromised web page. Affected organizations are those embedding the Content Credentials Rust SDK or running the command-line tool in content pipelines; the impact is limited to integrity (C:N/I:H/A:N), meaning tampered provenance/manifest data rather than data theft, denial of service, or code execution. No public exploit identified at time of analysis and the issue is not reported as actively exploited; Adobe has published advisory APSB26-147, so patched builds should be applied as routine hygiene.
Improper input validation in Adobe Content Credentials - specifically the Content Credentials Rust SDK and its companion command-line tool - allows remote, unauthenticated attackers to bypass a security check and obtain limited unauthorized write access when a victim visits a maliciously crafted URL or interacts with a compromised web page. The flaw is network-delivered (AV:N/AC:L/PR:N) but is gated by mandatory user interaction (UI:R), and its impact is confined to limited integrity loss (C:N/I:L/A:N) with no confidentiality or availability effect, giving it a CVSS base score of 4.3. This is a genuine but low-priority issue: no public exploit code has been identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, and it is not exploitable against a purely passive or non-interacting deployment.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.