What is the CVSS score of CVE-2026-48287?

CVE-2026-48287 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of C2Pa are affected by CVE-2026-48287?

Adobe Content Authenticity tooling (c2pa Rust SDK ≤0.84.0, @contentauth/c2pa-web JS SDK ≤0.7.0, c2patool CLI ≤0.16.5) contains a high-severity arbitrary code execution vulnerability through untrusted…

How to fix or mitigate CVE-2026-48287?

Within 24 hours, inventory all systems and dependencies using the affected Adobe Content Authenticity SDK versions (Rust ≤0.84.0, JavaScript ≤0.7.0, CLI ≤0.16.5) and classify by production exposure. Within 7 days, implement compensating controls including restriction of affected tool execution to sandboxed or offline environments, strict input validation for external URLs and content sources, and enhanced monitoring for suspicious process execution or library loading attempts originating from these SDKs. Within 30 days, establish automated patch deployment procedures and monitor Adobe's security advisories for patched versions; prepare a rollout plan for immediate update upon vendor release.

C2Pa CVE-2026-48287

EUVD-2026-44524 HIGH

Untrusted Search Path (CWE-426)

2026-07-14 psirt@adobe.com

GHSA-g23w-pc29-375j

RCE C2Pa C2Pa Web C2Patool

7.4

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:33 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 7.4

DescriptionCVE.org

CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

AnalysisAI

Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0), the @contentauth/c2pa-web JS SDK (≤0.7.0), and the c2patool CLI (≤0.16.5) — arises from an untrusted search path (CWE-426) that loads attacker-controlled libraries and runs code as the current user. Adobe PSIRT reports the flaw requires victim interaction (visiting a crafted URL or interacting with a compromised page) and a local attack vector, and there is no public exploit identified at time of analysis. EPSS is low (0.14%, 4th percentile) and CISA SSVC records exploitation as 'none', consistent with a not-yet-exploited but total-technical-impact issue.