CVE-2026-95632: 
NixOS vulnerability analysis and mitigation

CVE-2026-95632 is an Improper Verification of Cryptographic Signature vulnerability (CWE-347) affecting Adobe's CAI Content Credentials ecosystem, including the Content Credentials Rust SDK, C2PA Tool, and Content Credentials JS SDK. The vulnerability allows an unauthenticated network attacker to bypass cryptographic signature verification and gain unauthorized write access to protected content credentials. Affected versions include Content Credentials Rust SDK up to and including c2pa-v0.90.15, C2PA Tool up to and including c2patool-v0.27.15, and Content Credentials JS SDK up to and including @contentauth/c2pa-web@0.13.4. Disclosed on October 13, 2026, it carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Adobe Advisory).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature), meaning the affected components fail to correctly verify cryptographic signatures on content credential data. This flaw is exploitable remotely over the network with low attack complexity, requiring no privileges and no user interaction, making it automatable. The attack pattern aligns with CAPEC-475 (Signature Spoofing by Improper Validation), where an attacker crafts or modifies content credential data in a way that bypasses the signature check, enabling unauthorized write access to credential metadata. No public proof-of-concept code has been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass the cryptographic integrity protections of Adobe's Content Credentials (C2PA) framework, gaining unauthorized write access to content credential metadata. The primary impact is a high integrity loss — attackers could forge, tamper with, or inject false provenance and authenticity data into media assets, undermining the trust guarantees that Content Credentials are designed to provide. Confidentiality and availability are not directly impacted, but the ability to manipulate content provenance records could have significant downstream consequences for workflows relying on C2PA for media authenticity verification (GitHub Advisory, Adobe Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.459%, placing it in the 38th percentile for exploitation likelihood within 30 days. However, the vulnerability is rated as automatable by NVD SSVC analysis, meaning exploitation could be scripted at scale without manual interaction, which elevates the risk profile despite the current absence of known exploits (GitHub Advisory).

Adobe has released patched versions for all three affected components. Users should update immediately to the following fixed versions: Content Credentials Rust SDK to c2pa-v0.91.1 or later, C2PA Tool to c2patool-v0.28.1 or later, and Content Credentials JS SDK to @contentauth/c2pa-web@0.15.3 or later. No configuration-based workarounds have been published; upgrading to the patched versions is the only recommended remediation. Given the network-accessible, unauthenticated nature of this vulnerability, updates should be applied as a priority (Adobe Advisory, GitHub Advisory).

The vulnerability received limited but notable coverage shortly after disclosure, with mentions on Mastodon via The Hacker Wire and aggregation by security feed services such as cvefeed.io and cve.report. No significant researcher commentary or major media coverage has been identified beyond standard vulnerability tracking and advisory distribution (GitHub Advisory).