What is the CVSS score of CVE-2026-48357?

CVE-2026-48357 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials SDK CVE-2026-48357

EUVD-2026-44526 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-14 psirt@adobe.com

GHSA-c5hm-56x3-6335

Denial Of Service C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

c2pa-web processes remotely-submitted content in Node.js servers, making AV:N the realistic attack vector for the most exposed deployment; no auth or interaction required.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:01 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe's C2PA Content Credentials Rust SDK, CLI tool (c2patool), and JavaScript web SDK allows a local attacker supplying a crafted input to exhaust system resources and crash the application. All three library families are affected across distinct runtimes - Rust, Node.js, and native binary - with patched releases available for each. No public exploit exists, SSVC classifies exploitation as none, and EPSS sits at the 5th percentile, indicating low real-world exploitation pressure despite the zero-user-interaction requirement.

Technical ContextAI

The Coalition for Content Provenance and Authenticity (C2PA) standard embeds cryptographically signed provenance manifests inside media files. Adobe's reference implementations - the Rust SDK (cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*), the Node.js web SDK (cpe:2.3:a:adobe:c2pa-web:*:*:*:*:*:node.js:*:*), and the standalone command-line tool (cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*) - all parse these manifests during content verification. CWE-400 (Uncontrolled Resource Consumption) indicates a parsing path that does not impose bounds on memory allocation, loop iteration, or recursion depth when encountering a malformed or adversarially crafted C2PA manifest, ultimately causing the hosting process to exhaust available resources. The flaw spans three distinct codebases sharing the same conceptual parsing logic.

RemediationAI

Upgrade to the patched releases confirmed by Adobe PSIRT and EUVD: Rust SDK to c2pa-v0.85.2, Command-Line Tool to c2patool-v0.26.65, and JavaScript Web SDK to @contentauth/c2pa-web@0.9.0. The full vendor advisory is at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html (APSB26-80). If immediate upgrade is not feasible for the c2pa-web deployment, restrict the file-upload endpoint to authenticated and rate-limited clients to reduce the ability of an external attacker to submit crafted manifests at volume - be aware this trades usability for risk reduction. For c2patool in automated pipelines, limit input sources to trusted, internally generated files and avoid processing user-supplied media until patched. No known workaround eliminates the root cause; patching is the only confirmed fix.