What is the CVSS score of CVE-2026-48298?

CVE-2026-48298 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials CVE-2026-48298

EUVD-2026-44519 MEDIUM

Integer Underflow (CWE-191)

2026-07-14 psirt@adobe.com

GHSA-3384-2cr5-cq96

Integer Overflow Denial Of Service C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local file-based trigger requires no privileges or interaction; crash impact is purely availability with no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:32 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer underflow (CWE-191) in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa), JavaScript/Node.js SDK (c2pa-web), and c2patool command-line utility - crashes the application when processing a maliciously crafted C2PA manifest or media file, resulting in a denial-of-service condition. All three components share the same vulnerable code path, broadening the attack surface across toolchains. No public exploit has been identified at time of analysis; EPSS at 0.15% (5th percentile) and SSVC exploitation status of 'none' confirm this is not currently being targeted.

Technical ContextAI

The C2PA (Coalition for Content Provenance and Authenticity) standard embeds cryptographically signed provenance manifests into media files. Adobe's implementation spans a Rust SDK (cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), a Node.js web SDK (cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and a standalone command-line tool (cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*). CWE-191 (Integer Underflow / Wrap-around) indicates that during parsing or validation of manifest fields, an arithmetic operation on an unsigned or bounded integer produces a value that wraps below its minimum, causing the application to read or allocate based on an anomalously large or zero-length value and subsequently crash. This class of defect is particularly common in binary format parsers where length or offset fields are attacker-controlled.

RemediationAI

Vendor-released patches are available for all three components. Upgrade the Rust SDK to c2pa-v0.85.2, the JavaScript SDK to @contentauth/c2pa-web@0.9.0, and the command-line tool to c2patool-v0.26.65 per Adobe security advisory APSB26-80 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html. Note that the c2patool patch version jump (from ≤0.16.5 to 0.26.65) is unusually large and should be verified against official release notes before deployment. As a compensating control prior to patching, restrict intake of C2PA manifests to trusted, internally generated sources and reject externally supplied media files in automated processing pipelines until the patch is applied. Disabling C2PA manifest parsing entirely is feasible if content provenance validation is not a production requirement, with the trade-off of losing content authenticity verification.