Executive brief
Adobe Content Credentials is a toolset used to verify the authenticity and origin of digital content. A security flaw in this software could allow an attacker to run unauthorized code on a user's computer if the user is tricked into visiting a malicious website or clicking a specific link. This could lead to the theft of sensitive information or unauthorized changes to the user's system.
Technical details
An Untrusted Search Path vulnerability (CWE-426) exists in the Adobe Content Credentials SDKs and CLI tools. The flaw occurs when the application attempts to load a resource or library without a fully qualified path, potentially allowing a local attacker to place a malicious file in a directory searched by the application. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page. Successful exploitation can lead to arbitrary code execution in the context of the current user. Fixed versions include Rust SDK c2pa-v0.85.2, CLI tool c2patool-v0.26.65, and JS SDK @contentauth/c2pa-v0.16.6.
Affected products
- Adobe Content Credentials Rust SDK <= c2pa-v0.84.0
- Adobe Content Credentials Command-Line Tool <= c2patool-v0.16.5
- Adobe Content Credentials JS SDK <= @contentauth/c2pa-v0.16.5
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory