The affected Adobe CAI Content Credentials releases (c2pa-web@0.7.0, c2pa-v0.78.2, and earlier) contain an integer underflow that can be triggered by crafted input (inferred from limited data). The wraparound allows a negative value to be processed, causing allocation logic to fail and the application to crash. This results in a denial-of-service condition without requiring user interaction. The weakness is CWE-191.

Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and all earlier releases are affected. These versions are used to sign and verify content in Adobe applications that rely on the Content Authenticity SDK.

The CVSS score of 6.2 indicates moderate severity, but the exploit does not require user interaction, so an attacker could potentially trigger the failure from any vector that can send crafted input or configuration to the software (inferred from limited data). The EPSS score is 0.00012, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been widely observed in the wild. Nonetheless, because it results in a program crash, any exploitation would immediately disrupt availability and should be treated with high priority.