What is the CVSS score of CVE-2026-48352?

CVE-2026-48352 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Adobe C2PA are affected by CVE-2026-48352?

An unauthenticated denial-of-service vulnerability in Adobe's Content Credentials (C2PA) SDKs allows remote attackers to crash applications that validate digital asset provenance.

How to fix or mitigate CVE-2026-48352?

Within 24 hours, conduct a comprehensive inventory of all applications, services, and infrastructure components using Adobe C2PA SDKs (c2pa Rust SDK ≤0.84.0, c2patool ≤0.16.5, @contentauth/c2pa-web JavaScript SDK ≤0.7.0) and document their production exposure. Within 7 days, implement upstream input validation and schema enforcement on all external media manifests and assets before they reach the SDK, configure application monitoring for crashes specific to malformed input patterns, and establish a communication channel with your Adobe account team to track patch development timeline. Within 30 days, prepare a comprehensive upgrade and testing plan for SDK versions once Adobe releases patches, document all compensating controls in your CMDB, and schedule a post-patch deployment date to your change advisory board.

Adobe C2PA CVE-2026-48352

EUVD-2026-44518 HIGH

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-5hq2-2w88-w4q8

Denial Of Service C2Pa C2Pa Web C2Patool

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated, no-interaction crash from a crafted input parsed by the library gives AV:N/AC:L/PR:N/UI:N; impact is availability-only (A:H) with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:02 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on the c2pa Rust SDK (≤0.84.0), the c2patool command-line utility (≤0.16.5), or the @contentauth/c2pa-web JavaScript SDK (≤0.7.0) by supplying malformed input that the library fails to validate. Because exploitation requires no authentication and no user interaction, an application that ingests attacker-controlled assets or manifests can be reliably knocked offline. There is no public exploit identified at time of analysis, and the low EPSS (0.41%) with CISA SSVC exploitation status of 'none' indicates no observed activity yet, though the flaw is assessed as automatable.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is an open standard for cryptographically signed content provenance / Content Credentials, embedded as manifests in media files. The affected components are Adobe's reference implementations: the Rust core SDK (cpe:2.3:a:adobe:c2pa, ecosystem 'rust'), the c2patool CLI, and the c2pa-web binding (ecosystem 'node.js'). The root cause is CWE-20 (Improper Input Validation): the manifest/asset-parsing path accepts untrusted input without adequately validating structure or bounds, and a malformed input drives the process into a crash (e.g. panic, unhandled exception, or resource exhaustion). Any downstream product that links these libraries to read or verify Content Credentials inherits the exposure.

RemediationAI

Vendor-released patch: upgrade the Rust SDK to c2pa-v0.85.2, the command-line tool to c2patool-v0.26.65, and the JS SDK to @contentauth/c2pa-web@0.9.0, as documented in Adobe advisory APSB26-80 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html); rebuild and redeploy any downstream application that statically links these libraries, since patching the app binary alone is not sufficient if it bundles a vulnerable version. Until upgrades land, reduce exposure by not passing untrusted or externally sourced assets directly into the SDK's parsing/verification path - validate or sandbox file ingestion, enforce strict size and format limits before handing data to c2pa, and run the parsing component as an isolated, restartable worker process so a crash degrades rather than takes down the whole service; the trade-off is added latency and architectural complexity, and these controls only limit blast radius rather than eliminate the crash. There is no confidentiality or integrity risk, so the priority is availability resilience.