Adobe C2PA SDK CVE-2026-48354

Exploitation requires that the attacker can cause the vulnerable c2pa Rust SDK, c2pa-web JS SDK, or c2patool CLI to parse a locally accessible C2PA manifest file that the attacker has crafted or modified. No authentication is required (PR:N) and no user interaction beyond the application's normal C2PA processing workflow is needed (UI:N), but the attack vector is local (AV:L), meaning the attacker must be able to supply the malicious file to the processing application - either by writing to a watched directory, uploading to an ingest pipeline, or otherwise controlling the file input path. Exploitation is limited to denial of service (process crash); there is no code execution or data exfiltration component. Applications that do not process externally supplied C2PA manifests, or that sandbox the parsing process, are not meaningfully exposed. Non-default configurations are not a prerequisite - any use of the affected library versions to parse C2PA data is sufficient.

CVSS scores this 6.2 (Medium) with a local attack vector (AV:L), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N), with high availability impact. This combination is somewhat unusual: PR:N/UI:N suggests no authentication or interaction is needed, yet AV:L constrains the attacker to local input delivery - consistent with supplying a malicious C2PA file that a local process then parses. EPSS is 0.15% (5th percentile), reflecting very low exploitation probability in the wild. SSVC independently confirms exploitation status as 'none' and automatable as 'no', meaning mass or opportunistic exploitation is not assessed as feasible at this time. There is no CISA KEV listing. The sole impact is availability (A:H), with no confidentiality or integrity exposure. The real-world priority is moderate: patching is straightforward given vendor-released fixes exist across all three components, and the blast radius is limited to process crashes rather than data exfiltration or code execution. The CVSS AV:L rating should be verified against the vendor advisory - if the C2PA file can be fetched from a remote URL and auto-processed by an application, the effective attack surface may be broader than the vector implies.

An attacker crafts a C2PA manifest file containing an oversized or boundary-condition integer field (such as a manifest size, item count, or byte-length value) and places it in a location where the target application will process it - for example, embedding it in a media file submitted to a content verification workflow. When the application calls into the c2pa Rust SDK or c2patool to verify the file's provenance, the parser encounters the malformed integer, overflows, and the process crashes, taking down any service dependent on that process.