The vulnerability is an improper verification of a cryptographic signature, which allows an attacker to create or modify content that appears to be signed by a trusted source. Because the verification step is missing or flawed, the attacker can gain the same level of trust that the original signed content would have. The impact is the ability to write or alter protected data or content without the proper authorization, effectively bypassing the security feature that relies on signature validation.

Adobe C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. No specific product versions were provided, so all current releases of these components should be reviewed for the presence of the flaw.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests the probability of exploitation is currently low. The vulnerability can be exploited without any user interaction, implying that either a remote or local attacker could gain write access directly if the component is exposed. The issue is not listed in the CISA KEV catalog, so it has not yet been widely reported or observed. Overall, the risk is moderate to high, with a potentially significant impact if an attacker can manipulate the content creation or editing process.