The flaw arises from improper verification of cryptographic signatures in CAI Content Credentials, classified as CWE-347. This permits a malicious actor to forge a valid signature, which the tool or SDK accepts as legitimate, thereby enabling unauthorized write access to protected content or metadata and undermining data integrity. No user interaction is required for exploitation.

Adobe C2PA Tool, Adobe Content Credentials JS SDK, and Adobe Content Credentials Rust SDK are affected. No specific version information is provided, so any installation of these components that has not applied the official fix may be vulnerable.

The vulnerability carries a CVSS score of 7.5, indicating moderate to high severity, and an EPSS score of less than 1%, indicating a low but non‑zero exploitation probability. It is not listed in CISA KEV. The likely attack vector is remote exploitation via client SDK or tool interactions when processing or creating signed content; based on the description, it is inferred that an attacker could forge signed data and feed it into the SDK, allowing malicious changes without user interaction.