CVE-2026-71389

MediumCVSS 6.2/10Last modified Aug 28, 2026

Description

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191

Affected software

Vendor	Product	Versions
Adobe	Content Credentials Rust SDK	<= c2pa-v0.90.5
Adobe	Content Credentials Command-Line Tool	<= c2patool-v0.27.5
Adobe	Content Credentials JS SDK	<= @contentauth/c2pa-web@0.12.0

References

https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.htmlVendor Advisory

Timeline

Published: Aug 11, 2026
Last modified: Aug 28, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-71399.8A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.CVE-2026-713904.0CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke CVE-2026-713915.3GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfn CVE-2026-713925.3GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a craft CVE-2026-713935.3GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size CVE-2026-713945.3GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparis CVE-2026-713965.4Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.CVE-2026-7139810.0Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the co CVE-2026-713997.8Adobe XD is affected by a Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. An CVE-2026-71409.8A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi CVE-2026-714015.3An integer underflow was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c does not verify CVE-2026-714025.4An out-of-bounds read was found in the DHCPv4 packet capture code of wicked. ni_capture_inspect_udp_header() in src/capture.c reports the IP