Executive brief
Adobe CAI Content Credentials, a toolset used to verify the authenticity and origin of digital content, is affected by a security flaw that can cause applications using it to crash. By providing specially crafted input, an attacker can trigger a denial-of-service condition, making the affected software unavailable. This could disrupt workflows that rely on verifying digital media provenance and content authenticity.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Adobe Content Authenticity Initiative (CAI) SDKs, specifically the c2pa-web (Node.js) and c2pa-v (Rust) implementations. The flaw allows an attacker to provide malformed input that the library fails to process correctly, leading to an application crash. The attack vector is classified as local, meaning the attacker must be able to provide input to an application utilizing these libraries. No user interaction or specific privileges are required to trigger the crash. Patches are available in c2pa-web version 0.7.1 and c2pa-v version 0.80.1.
Affected products
- Adobe c2pa-web <= 0.7.0
- Adobe c2pa-v (Rust SDK) <= 0.78.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory