The vulnerability is an integer overflow or wraparound in CAI Content Credentials. An attacker can supply large numeric values that cause the program to wrap a signed integer, triggering a crash that terminates the application. The crash results in a denial‑of‑service condition for users of the affected SDK. No user interaction is needed, and the weakness is identified as CWE‑190.

Adobe C2PA Tool, Adobe Content Credentials JS SDK, and Adobe Content Credentials Rust SDK are affected. Version information is not provided in the current advisory, so all current releases may be vulnerable until a patch is issued. The vendors listed by the CNA are the authoritative sources for this issue.

The CVSS score of 7.5 indicates high severity with a focus on availability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not currently identified in the CISA KEV catalog, indicating no known active exploitation campaigns. Exploitation can be performed by sending crafted numeric input that causes the integer to wrap; because it requires no special privilege or user interaction, the attack vector is likely remote, dependent on how the SDK is used within an application.