The CAI Content Credentials components contain an improper access control flaw that allows an attacker to bypass built‑in security checks and gain write privileges without user interaction. This privilege escalation can be leveraged to modify or overwrite protected content, compromising data integrity and potentially enabling further malicious activities.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK. All versions of these components before the vendor’s latest patch are affected; the CVE description does not specify individual versions, so any unpatched installation is at risk.

The CVSS score of 7.5 indicates a high severity, while an EPSS score of less than 1% suggests a low probability of real‑world exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The flaw does not require user interaction; an attacker can remotely supply a crafted input to the affected SDKs or C2PA Tool to trigger unauthorized write operations, thereby bypassing critical security controls.