What is the CVSS score of CVE-2026-48312?

CVE-2026-48312 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Content Credentials SDK CVE-2026-48312

EUVD-2026-44523 MEDIUM

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-fgvf-cxjx-m6vg

Authentication Bypass C2Pa C2Pa Web C2Patool

6.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.8 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

6.8 MEDIUM

Local attack vector aligns with manifest-level input control; no system privileges needed to supply a crafted manifest; high integrity impact reflects ability to forge content provenance data.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:31 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

AnalysisAI

Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), and CLI tool (≤0.16.5) - allows unauthorized write access to content provenance data through improper input validation (CWE-20). No active exploitation is confirmed: SSVC rates exploitation as none, the vulnerability is absent from CISA KEV, and EPSS sits at 0.16% (6th percentile), signaling low real-world threat pressure at this time. Adobe has released patches across all three components under advisory APSB26-80.

Technical ContextAI

Adobe's C2PA (Coalition for Content Provenance and Authenticity) SDKs provide cryptographically verifiable content credentials embedded in media files, establishing trusted provenance chains to authenticate digital content origin and edit history. The vulnerability is rooted in CWE-20 (Improper Input Validation) and affects three distinct implementations identified by CPE: the Rust library (cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), the Node.js library (cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and the command-line tool (cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*). The failure to properly validate crafted C2PA manifests allows bypass of the integrity enforcement logic that gates write access to content credentials, undermining the provenance assurance model these libraries are expressly designed to enforce.

RemediationAI

Upgrade all affected components to their respective patched releases: Rust SDK to c2pa-v0.85.2, JavaScript SDK to @contentauth/c2pa-web@0.9.0, and the command-line tool to c2patool-v0.26.65. These versions are confirmed in both the Adobe advisory APSB26-80 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html) and EUVD-2026-44523. If immediate patching is not feasible, restrict local access to C2PA manifest processing pipelines to trusted users only - note this trades off workflow accessibility for integrity protection. Avoid ingesting externally-supplied or attacker-influenced C2PA manifests until patched, as the validation bypass requires the attacker to supply a crafted manifest as input.