Adobe Security Bulletin

Last updated on Jun 9, 2026

Security updates available for Content Credentials SDK | APSB26-61

Bulletin ID

Date published

Priority

APSB26-61

June 9, 2026

3

style

grid width 12

Summary

Adobe has released security updates for Content Credentials SDK. This update addresses critical and important vulnerabilities that could result in application denial-of-service and arbitrary file system write.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product

Affected version

Platform

Content Credentials JS SDK

@contentauth/c2pa-web@0.7.1 and earlier

Windows, macOS, Linux, iOS, Android

Content Credentials Rust SDK

c2pa-v0.80.1 and earlier

Windows, macOS, Linux, iOS, Android

style

grid width 12

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Availability

Content Credentials JS SDK

@contentauth/c2pa-web@0.8.3

Windows, macOS, Linux, iOS, Android

3

Release Notes

Content Credentials Rust SDK

c2pa-v0.85.1

Windows, macOS, Linux, iOS, Android

3

Release Notes

style

grid width 12

Vulnerability Details

CVE-2026-34711

Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Application denial-of-service
Severity: Critical
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-34712

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Application denial-of-service
Severity: Critical
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-34713

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: Critical
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-47902

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-47903

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-47904

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-47905

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 6.2
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-34657

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary file system write
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Acknowledgments

Adobe would like to thank the following researchers for reporting this issue and for working with Adobe to help protect our customers.

bau1u - CVE-2026-34712, CVE-2026-34713, CVE-2026-47902, CVE-2026-47903, CVE-2026-47904, CVE-2026-47905
exploitguru101 - CVE-2026-34711
Amirul Akmal Bin Amiruddin (m411) - CVE-2026-34657

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check us out here: https://app.intigriti.com/programs/adobe/adobepublic/detail.

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com

CardTitle

APSB26-61

CardDescription

Priority 3 Security update

CardImage

Created

2026-06-09