The vulnerability is an Improper Input Validation flaw, identified as CWE‑20, that affects CAI Content Credentials c2pa-web 0.7.0, c2pa-v0.78.2 and earlier. An attacker can supply malformed data to trigger a crash, resulting in denial of service. No user interaction is required to trigger the failure.

Adobe CAI Content Credentials products are affected, specifically version 0.78.2, 0.7.0 and earlier. These builds, when installed, are susceptible to the input validation issue.

The CVSS score of 6.2 indicates a moderate severity. The EPSS score indicates a probability of exploitation less than 1%, showing a low likelihood of exploitation but the flaw can still be abused without user interaction, suggesting a remote or network‑based attack path. The vulnerability is not listed in the CISA KEV catalog, reducing evidence of widespread exploitation yet the risk remains significant due to the inherent denial‑of‑service effect.