Adobe C2PA SDK CVE-2026-48295

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required, and CISA SSVC marks the issue Automatable. The concrete prerequisite is that a target application, service, or pipeline must embed one of the affected components - the Rust 'c2pa' crate (≤0.84.0), the JS '@contentauth/c2pa-web' (≤0.7.0), or 'c2patool' (≤0.16.5) - and expose its credential-handling functionality in a network-reachable way. The primary limiting factor is that these are libraries/tools rather than standalone network services, so exploitability depends on the consuming application actually exposing the vulnerable code path over the network; the impact is confined to confidentiality (read access only, I:N/A:N). The vendor description does not name the exact feature or configuration that triggers exposure, so the precise trigger path should be verified against Adobe APSB26-80.

The signals are mixed and lean toward moderate rather than urgent priority. CVSS 3.1 is 7.5 (High) with a network, low-complexity, unauthenticated, no-interaction vector and high confidentiality impact - which on its own suggests easy remote exploitation - but the corroborating threat signals are weak: EPSS is only 0.39% (31st percentile), it is not on the CISA KEV list, and the CISA SSVC assessment explicitly rates Exploitation as 'none' with Technical Impact as 'partial' (only confidentiality is affected; I:N/A:N). SSVC does flag Automatable: yes, consistent with the AV:N/PR:N vector. The apparent tension is that the CVSS network/unauthenticated vector is optimistic for a library-level credential-protection flaw: the vague vendor description does not specify the exact exposure path, so real-world exploitability hinges on how the embedding application handles the affected credentials - verify with the Adobe advisory (APSB26-80). Overall this is a genuine confidentiality issue worth patching on a normal cycle, not an emergency.

An attacker with network reach to a service built on the vulnerable C2PA SDK or c2patool queries or interacts with it and reads back credential material that should have been protected, gaining unauthorized access to sensitive secrets without authenticating or requiring any user action. Given SSVC 'Automatable: yes', such access could be scripted across many targets, though no public exploit code has been identified.