On October 2, 2026, security researcher David Buchanan (retr0id) published a demonstration that undercuts one of the stronger promises of content provenance. C2PA, the Coalition for Content Provenance and Authenticity standard behind Content Credentials, is used across a growing range of cameras, creative tools, and platforms, attaching a signed record to an image describing where it came from and when. Buchanan produced an image whose Content Credentials carry a valid signature and a valid trusted timestamp dated hours before a EuroMillions draw, yet showing the winning numbers. He is explicit that it is a demonstration, not fraud, but the point lands: the signature meant to make the image tamper-evident proves nothing about the pixels.
This blog explains how a valid signature can cover none of the file it is attached to, why the trusted timestamp does not save it, and what the technique means for anyone treating a Content Credential as proof an image is unaltered. The demonstrated weakness arises from how the C2PA specification defines and handles exclusion ranges, rather than from a flaw in a single vendor's implementation
1. What a Content Credential is meant to prove
A C2PA manifest usually carries two signatures. The first is the claim signature, asserting something like "this is a photograph taken at these coordinates at this time." Buchanan's earlier work showed that on flagship implementations this claim can be signed with whatever the signer likes, so it proves little alone. The second is the interesting one. Because devices are not trusted to report their own time, the manifest consults a remote Time Stamp Authority over the RFC 3161 protocol, which returns a signature meaning "I saw this hash at this time."That timestamp acts as an independent witness that, assuming the TSA is trusted and functioning correctly, establishes that the signed data existed at or before the specified time. Buchanan does not attack the timestamp authority and assumes it works as advertised. The bypass does not need it to fail.
2. The spec feature that lets a signature cover nothing
The weakness is a C2PA feature called exclusions. A manifest may declare byte ranges within the file that are left out of the signature calculation, and the idea is legitimate, because some formats need it. The feature has legitimate uses. Buchanan points to PNG as an example, where chunk CRC32 values need to be corrected after the C2PA signature is embedded, creating a circular dependency unless the relevant data is excluded . The concern is that the exclusion mechanism can permit a sufficiently large range to be excluded, creating a gap between what the signature covers and what the viewer sees. Buchanan's new angle is to use it deliberately and to its limit: a signer can exclude the entire file, producing a valid signature over an empty string. The manifest he dumped shows an exclusion covering all 3,995,383 bytes and a hash equal to the SHA-256 of nothing.
3. Why the timestamp does not help
This is where the two signatures combine into something worse than either alone. The claim signature covers the file hash, now corresponding to an empty input, and the timestamp authority signs the claim signature. The claim signature and timestamp signature remain cryptographically valid: the authority witnessed the claim at the stated time, the claim is signed, and the file carries both. What none of it witnesses is the image. Because the pixels sit entirely inside the excluded range, they can be changed after the timestamp is issued without invalidating anything, which is how an image signed before a lottery draw can show the results after.At the time of his disclosure, Buchanan reported that the C2PA verification tools he tested did not flag the file as unusual.
4. Why this is hard to fix, and what it means
The obvious fix, rejecting a file that excludes everything, is easy to state and insufficient, because the danger does not require excluding the whole file. The difficulty is that even a smaller exclusion can be problematic if changes within that region can materially affect how the asset is interpreted. Buchanan points to existing hash-collision proof-of-concepts as an example of why the boundary is not always straightforward. Removing exclusions entirely is not an option either, since formats like PNG need them. Buchanan's proposed direction is to specify, per file format, which byte ranges may be excluded, and to require verifiers to enforce those limits. Until something like that lands, the practical reading is narrow and important. A Content Credential proves a manifest was signed, and with a trusted timestamp, that it was signed by a given time. It does not, by itself, prove that the image you are looking at is the one that was signed. For anyone basing trust decisions, journalistic, legal, or platform moderation, on a valid credential, that gap is the point.
Content provenance is a useful idea, and C2PA is the most serious attempt at it so far. Demonstrations like this are how a young standard gets hardened before the trust placed in it outruns what it can deliver. The signature is valid, the timestamp is valid, yet the image content was modified after the signed data was established. That distinction is the central lesson of the research.
For organizations relying on cryptographic controls to support trust decisions, technical security assessment can help evaluate how those controls are implemented and whether their validation mechanisms behave as expected. Laburity provides security assessments and testing services to help organizations evaluate relevant security controls and identify technical weaknesses .
Need to assess your security controls? Book a consultation, contact us, or explore our services.
