An integer underflow (wrap or wraparound) in CAI Content Credentials could allow an attacker to force the application to crash, resulting in a denial‑of‑service. The flaw sits in the parsing logic that does not enforce bounds on numeric values, and it is classified as CWE‑191. No user interaction is required to trigger it; an attacker can simply supply malformed data to the component.

Adobe CAI Content Credentials versions 0.78.2, 0.7.0, and all earlier releases are affected. These versions are included in the Adobe Content Authenticity SDK, which is used by publishers to verify the integrity of digital content.

The CVSS score of 6.2 indicates that the vulnerability is of moderate severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, so the current probability of exploitation is unknown. However, because the flaw can be triggered without any user interaction, it could be exploited remotely or locally by an attacker who can provide crafted input. The resulting denial‑of‑service could disrupt content delivery or transactional systems that rely on the SDK.