What is the CVSS score of CVE-2026-48354?

CVE-2026-48354 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Adobe C2PA SDK CVE-2026-48354

EUVD-2026-44520 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-14 psirt@adobe.com

GHSA-q7c5-gxmx-jxmg

Integer Overflow Denial Of Service C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local file input triggers parsing with no credentials needed; only availability is impacted via process crash.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:01 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe's Content Credentials SDK family (c2pa Rust SDK, c2pa-web JS SDK, and c2patool CLI) allows a local attacker to crash any application that processes a specially crafted C2PA manifest, resulting in denial of service. All three components share the vulnerable parsing logic and are affected across versions up to c2pa-v0.84.0, @contentauth/c2pa-web@0.7.0, and c2patool-v0.16.5 respectively. No public exploit exists and SSVC confirms no observed exploitation; however, patches are available and should be applied given the zero-privilege-required local trigger condition.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is an open standard for embedding cryptographically signed provenance metadata into digital media files. Adobe maintains three affected implementations: a core Rust library (cpe:2.3:a:adobe:c2pa), a Node.js/WebAssembly binding (cpe:2.3:a:adobe:c2pa-web), and a standalone CLI tool (cpe:2.3:a:adobe:c2patool). CWE-190 (Integer Overflow or Wraparound) indicates that a size, length, or count field in a parsed C2PA manifest can be manipulated to wrap around the integer bounds, causing the allocator or a downstream computation to operate on a corrupt value and ultimately panic or crash. In Rust this typically surfaces as an arithmetic overflow panic in debug builds or silent wraparound leading to an out-of-bounds access in release builds; both paths terminate the process. The AV:L CVSS vector confirms that exploitation requires the attacker to influence the input file processed by the host application, rather than reaching the parser over a network socket directly.

RemediationAI

Vendor-released patches exist for all three affected components. Upgrade the Rust SDK to c2pa-v0.85.2 or later, the JavaScript SDK to @contentauth/c2pa-web@0.9.0 or later, and the CLI tool to c2patool-v0.26.65 or later. Full patch details are documented in Adobe advisory APSB26-80 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html. If immediate patching is not possible, a specific compensating control is to restrict the set of C2PA files processed by the application to those sourced from trusted, validated origins - for example, blocking processing of externally supplied or user-uploaded C2PA manifests until the patch is applied. This reduces exposure without disabling the feature entirely, though it does limit content provenance verification for untrusted media. No known workaround fully mitigates the integer overflow without applying the patch.