Quick answers
- Is CVE-2026-34713 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-34713 being exploited in the wild.
- How severe is CVE-2026-34713?
- High severity, with a CVSS score of 7.5, published 9 June 2026.
- Which products and versions are affected?
- Adobe Content Authenticity SDK (c2pa-rs) 0.80.1 and earlier; Adobe Content Authenticity SDK (c2pa-web) 0.7.1 and earlier.
- Is there a fix for CVE-2026-34713?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-34713 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-34713?
- Check whether you run Adobe Content Authenticity SDK (c2pa-rs) or Adobe Content Authenticity SDK (c2pa-web) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in the Adobe Content Authenticity SDK (specifically the c2pa-web and c2pa-rs implementations). The flaw allows a remote, unauthenticated attacker to send specially crafted requests or data that exhaust system resources. This results in a denial-of-service (DoS) condition for the affected application. The attack can be carried out over the network without any user interaction. Adobe has addressed this in APSB26-61; users should update to the latest versions of the SDK.
Affected products
- Adobe Content Authenticity SDK (c2pa-web) 0.7.1 and earlier
- Adobe Content Authenticity SDK (c2pa-rs) 0.80.1 and earlier
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory: Adobe APSB26-61 published