Is CVE-2026-34679 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34679 being exploited in the wild.

How severe is CVE-2026-34679?

Medium severity, with a CVSS score of 6.2, published 12 May 2026.

Which products and versions are affected?

Adobe c2pa-v (Rust SDK) <= 0.78.2; Adobe C2pa-Web <= 0.7.0; Adobe Content Credentials SDK 0.78.2, 0.7.0 and earlier.

Is there a fix for CVE-2026-34679?

A patch was published on 2026-05-15: NIST records indicate patches in c2pa-web 0.7.1 and c2pa 0.80.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34679 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-34679?

Check whether you run Adobe C2pa, Adobe c2pa-v (Rust SDK), Adobe C2pa-Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34679: Adobe CAI Content Credentials denial of service via improper input validation

Q: Is there a fix for CVE-2026-34679?

A patch was published on 2026-05-15: NIST records indicate patches in c2pa-web 0.7.1 and c2pa 0.80.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34679 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-34679?

Check whether you run Adobe C2pa, Adobe c2pa-v (Rust SDK), Adobe C2pa-Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34679 · Severity: medium · CVSS 6.2 · Published 2026-05-12

Adobe CAI Content Credentials, a toolset used to verify the authenticity and origin of digital content, is affected by a security flaw that can cause applications using it to crash. An attacker could provide specially crafted data to trigger this failure, resulting in a denial-of-service. This impact prevents users from verifying content credentials and may disrupt workflows that rely on this security metadata.

Technologies: Adobe C2pa, Adobe c2pa-v (Rust SDK), Adobe C2pa-Web, Adobe Content Credentials SDK. Vendors: Adobe.

Quick answers

Is CVE-2026-34679 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34679 being exploited in the wild.
How severe is CVE-2026-34679?: Medium severity, with a CVSS score of 6.2, published 12 May 2026.
Which products and versions are affected?: Adobe c2pa-v (Rust SDK) <= 0.78.2; Adobe C2pa-Web <= 0.7.0; Adobe Content Credentials SDK 0.78.2, 0.7.0 and earlier.
Is there a fix for CVE-2026-34679?: A patch was published on 2026-05-15: NIST records indicate patches in c2pa-web 0.7.1 and c2pa 0.80.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34679 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-34679?: Check whether you run Adobe C2pa, Adobe c2pa-v (Rust SDK), Adobe C2pa-Web or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability (CWE-20) exists in the Adobe Content Authenticity Initiative (CAI) SDKs, specifically the c2pa-web (Node.js) and c2pa (Rust) implementations. The flaw allows an attacker to provide malformed input that the library fails to process safely, leading to an application crash. The attack vector is classified as local, meaning the malicious input must be processed by a local instance of the library, but it requires no special privileges or user interaction to trigger the denial-of-service condition. Patches have been released in c2pa-web version 0.7.1 and c2pa version 0.80.1.

Affected products

Adobe c2pa-web <= 0.7.0
Adobe c2pa-v (Rust SDK) <= 0.78.2

Timeline

2026-05-12: disclosed
2026-05-12: advisory
2026-05-15: patched: NIST records indicate patches in c2pa-web 0.7.1 and c2pa 0.80.1

References

https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.