Executive brief
Adobe Content Credentials is a set of tools and software development kits used to provide digital provenance and verify the authenticity of digital content. A security flaw in these tools allows a remote attacker to crash applications that use this technology by sending specially crafted data. This results in a denial-of-service, potentially disrupting services that rely on content verification without requiring any interaction from a user.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Adobe Content Credentials (CAI) SDKs and command-line tools. The flaw allows a remote, unauthenticated attacker to trigger an application crash by providing malformed input that the software fails to validate correctly. The attack vector is network-based and requires no prior privileges or user interaction. Affected components include the Rust SDK (up to v0.84.0), the JS SDK (up to v0.16.0), and the C2PA command-line tool (up to v0.16.5). Patches have been released in Rust SDK v0.85.2, JS SDK v0.17.0, and C2PA Tool v0.26.65.
Affected products
- Adobe Content Credentials Rust SDK <= c2pa-v0.84.0
- Adobe Content Credentials Command-Line Tool <= c2patool-v0.16.5
- Adobe Content Credentials JS SDK <= @contentauth/c2pa-v0.16.0
Timeline
- 2026-07-14: advisory
- 2026-07-14: disclosed