CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier contain an integer underflow (wrap or wraparound) vulnerability that can cause the application to crash, resulting in a denial‑of‑service condition. Based on the description, it is inferred that the flaw originates from insufficient bounds checking in the parsing logic of numeric values, and it is classified as CWE‑191. Importantly, the vulnerability can be triggered without user interaction; an attacker can supply crafted input to the component to induce the crash.

Adobe CAI Content Credentials versions 0.7.0, 0.78.2, and all earlier releases are affected. These versions are integrated into the Adobe Content Authenticity SDK, which publishers use to verify the integrity of digital content.

The CVSS score of 6.2 indicates moderate severity. The EPSS score is less than 1 % and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation is low but uncertain. Because no user interaction is required, an attacker could trigger the flaw remotely by supplying malicious data to an exposed component, or locally if the attacker can directly supply input, potentially disrupting content delivery or transactional systems that rely on the SDK.