An improper verification of a cryptographic signature allows an attacker to bypass built‑in security mechanisms and receive write permissions on protected content, enabling manipulation or corruption of digitally signed material without user interaction. The weakness stems from a flaw in signature validation (CWE‑347) and can compromise confidentiality, integrity, and potentially availability of affected assets.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are impacted. No specific version information is provided, but all current releases should be audited for the verification fix.

The CVSS score of 7.5 indicates a high severity vulnerability; however, the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild at present. The issue is not listed in the CISA KEV catalog, and it can be exploited by crafting a malicious package that passes unsigned checks, thereby granting an attacker write access without any user interaction.