CVE-2026-34712: CAI Content Credentials | Improper Input Validation (CWE-20)

Synopsis

An improper input validation vulnerability in CAI Content Credentials (c2pa-v0.80.1 and earlier, c2pa-web@0.7.1 and earlier) allows a remote, unauthenticated attacker to crash the application by sending malformed input over the network. No authentication or user interaction is needed to trigger the flaw. Successful exploitation causes a denial-of-service condition, taking the affected service offline. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; the CVSS vector specifies AV:N, meaning no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, so any unauthenticated party who can reach the service can attempt exploitation.

• Victim interactionNot required

  The exploit fires without any action from a user or operator; the CVSS vector specifies UI:N.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• Crashes the affected c2pa application process, taking content-credential verification or signing functionality offline for the duration of the outage.
• Repeated exploitation can sustain a continuous denial-of-service, preventing any workload that depends on the c2pa service from processing content credentials.