CVE-2026-104345: 
NixOS vulnerability analysis and mitigation

CVE-2026-104345 is an Improper Input Validation vulnerability (CWE-20) affecting Adobe's CAI Content Credentials ecosystem, which enables security feature bypass and unauthorized write access. The vulnerability was published on October 13, 2026, and affects the Content Credentials Rust SDK (c2pa) through v0.90.15, C2PA Tool (c2patool) through v0.27.15, and the Content Credentials JS SDK (c2pa-web) through v0.13.4. Exploitation requires no authentication and no user interaction. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Adobe Advisory).

The root cause is improper input validation (CWE-20) within the CAI Content Credentials libraries, allowing an attacker to supply malformed or unexpected input that bypasses security controls enforced by the SDK. The attack vector is network-based, requires low complexity, no privileges, and no user interaction, making it automatable at scale. The bypass enables unauthorized write access to content or metadata managed by the Content Credentials framework, which is designed to assert provenance and authenticity of digital media. No public proof-of-concept or detailed technical write-up has been disclosed at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass security measures and gain unauthorized write access to systems or data managed by the Content Credentials SDK. The primary impact is on integrity — an attacker could tamper with or forge content provenance metadata, undermining the trust guarantees that the C2PA (Coalition for Content Provenance and Authenticity) standard is designed to provide. Confidentiality and availability are not directly impacted according to the CVSS scoring (GitHub Advisory, Adobe Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time (GitHub Advisory). The vulnerability is classified as automatable by NVD SSVC analysis, meaning exploitation could be scripted without manual interaction. The EPSS score is approximately 0.498% (41st percentile), indicating a relatively low but non-negligible probability of exploitation within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

Adobe has released patched versions for all three affected components. Users should upgrade immediately to the following fixed versions:

• Content Credentials Rust SDK (c2pa): v0.91.1 or later
• C2PA Tool (c2patool): v0.28.1 or later
• Content Credentials JS SDK (@contentauth/c2pa-web): v0.15.3 or later

In addition to patching, organizations should implement input validation controls at the application layer, monitor for suspicious or unexpected write access attempts to content credential stores, and review access controls for any deployments integrating these SDKs (Adobe Advisory, GitHub Advisory).

The vulnerability received standard automated coverage across vulnerability tracking platforms including CVEFeed, Vulners, and CIRCL shortly after disclosure. A Mastodon post on infosec.exchange noted the CVE, consistent with routine community monitoring of Adobe security advisories. No notable researcher commentary, vendor statements beyond the official advisory, or significant media coverage has been identified at this time (GitHub Advisory).