What is the CVSS score of CVE-2026-48302?

CVE-2026-48302 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials CVE-2026-48302

EUVD-2026-44521 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-28w4-whch-hx99

Denial Of Service C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector because exploitation requires supplying input to a locally running process; PR:N since no elevated privileges are needed to run the CLI or call the SDK; C:N/I:N because impact is crash-only.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Improper input validation in Adobe's Content Credentials suite (C2PA Rust SDK, JS SDK, and c2patool CLI) allows a local attacker without privileges to crash the application by supplying malformed C2PA manifest content, resulting in a denial-of-service condition. Affected components span the Rust library (c2pa ≤ 0.84.0), the Node.js web SDK (@contentauth/c2pa-web ≤ 0.7.0), and the command-line tool (c2patool ≤ v0.16.5). No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none with non-automatable attack paths.

Technical ContextAI

The vulnerability resides in Adobe's open-source implementation of the Coalition for Content Authenticity (C2PA) specification - a standard for embedding cryptographic provenance metadata into digital media. Three distinct release artifacts are affected as confirmed by CPE strings: the Rust crate (cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), the Node.js/web SDK (cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and the standalone CLI tool (cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*). The root cause is CWE-20 (Improper Input Validation): the parsing or processing layer does not adequately validate attacker-controlled C2PA manifest data before consuming it, allowing a specially crafted payload to trigger an unhandled error or resource exhaustion that terminates the process. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a local attack surface consistent with file-based processing: no authentication or user interaction is required, but the attacker must supply input to the process locally - typical for CLI tools and embedded library callers.

RemediationAI

The primary fix is to upgrade to the patched releases confirmed by the EUVD data and Adobe advisory (APSB26-80): upgrade the Rust crate to c2pa-v0.85.2, upgrade the Node.js SDK to @contentauth/c2pa-web@0.9.0, and upgrade the CLI tool to c2patool-v0.26.65. Details and download links are available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html. If immediate patching is not feasible, compensating controls should focus on restricting the sources of C2PA manifest files processed by the tool or library: configure the application to accept manifests only from trusted, internally validated sources, and reject externally supplied or user-provided manifest files at the application boundary. For CLI deployments, restrict execution of c2patool to trusted operators and controlled input paths via filesystem permissions. These controls reduce attack surface but do not eliminate the underlying validation defect; patching remains the definitive remediation.