« Volver al listado

CVE-2026-34711

Estado: AnalizadaAlta (7.5)—

CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector AV:N/AC:L/PR:N/UI:N indica exposición web remota sin autenticación. CWE-190 (Integer Overflow) causa crash del servicio. Aplicable a Adobe C2PA versiones expuestas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (2)

Adobe — C2paAdobe — C2pa-web

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-34711",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-34711",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-10T13:57:31.689077Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Content Credentials Rust SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "c2pa-v0.80.1"
            },
            {
              "status": "unaffected",
              "version": "c2pa-v0.85.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Adobe",
          "product": "Content Credentials JS SDK",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "@contentauth/c2pa-web@0.7.1"
            },
            {
              "status": "unaffected",
              "version": "@contentauth/c2pa-web@0.8.3",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T22:16:24.520",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CAI Content Credentials versions c2pa-web@0.7.1, c2pa-v0.80.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction."
    },
    {
      "lang": "es",
      "value": "Las versiones c2pa-web@0.7.1, c2pa-v0.80.1 y anteriores de CAI Content Credentials se ven afectadas por una vulnerabilidad de desbordamiento de entero o wraparound. Un atacante podría explotar esta vulnerabilidad para bloquear la aplicación, lo que llevaría a una condición de denegación de servicio. La explotación de este problema no requiere interacción del usuario."
    }
  ],
  "lastModified": "2026-08-28T00:17:26.647",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAC5EB4E-D740-4724-82DA-7C49F0138397",
              "versionEndIncluding": "0.80.1"
            },
            {
              "criteria": "cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4402A37D-5CCD-46EB-8942-3BA694C3F770",
              "versionEndIncluding": "0.7.1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705"
            },
            {
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
            },
            {
              "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}