The flaw is an improper certificate validation that allows a bypass of the security controls, ultimately permitting an attacker to gain unauthorized write access to protected resources. The description states that exploitation does not require user interaction and that it depends on conditions beyond the attacker’s control, indicating that the vulnerability can be leveraged by an attacker who can influence the data used in the validation process. The resulting compromise affects the integrity and availability of the system, as unauthorized write operations can alter or disrupt content managed by the tool.

Adobe’s C2PA Tool, Adobe’s Content Credentials JS SDK, and Adobe’s Content Credentials Rust SDK are impacted. No specific version information is disclosed in the available data, so all versions of these products are potentially affected until an update is released by Adobe.

The CVSS score of 5.9 rates the vulnerability as moderate, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at this time. The issue is not listed in the CISA KEV catalog. Based on the description, exploitation can be performed without user interaction, suggesting a remote or automated attack scenario once the necessary controlling conditions are met. The overall risk is moderate, but vigilance is advised due to the potential for significant integrity loss if the vulnerability is eventually exploited.