The vulnerability is an Improper Input Validation flaw, classified as CWE‑20, in Adobe CAI Content Credentials that affects versions c2pa-web@0.7.0, c2pa-v0.78.2, and all earlier releases. By supplying malformed input, an attacker can trigger a crash in the application, resulting in a denial‑of‑service for any service using the credentials component. The description provides no evidence of code execution, data disclosure, or privilege escalation, so the primary impact remains the loss of availability.

Adobe CAI Content Credentials versions 0.78.2, 0.7.0, and all earlier releases are affected. Any system or application that incorporates these versions of the credentials component is vulnerable.

The CVSS score of 6.2 indicates moderate severity. Because the EPSS score is <1% and the flaw is not listed in CISA’s KEV catalog, the likelihood of exploitation remains low but uncertain, although the description states that no user interaction is required. Based on the description, it is inferred that an attacker could trigger the crash remotely, potentially using crafted network input or a web request. Until a patch is applied, the risk is moderate but could become severe if the flaw is actively abused.