Skip to main content

Content Credentials CVE-2026-48387

| EUVDEUVD-2026-56278 MEDIUM
Integer Overflow or Wraparound (CWE-190)
2026-08-11 psirt@adobe.com GHSA-7f7v-xhq6-jf8p
Denial Of Service Integer Overflow Adobe C2Pa C2Pa Web C2Patool
6.2
CVSS 3.1 · Vendor: adobe
Share

Severity by source

Vendor (adobe) PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.2 MEDIUM

Local file delivery triggers the overflow without privileges or interaction; impact is availability-only with no scope change.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Aug 11, 2026 - 23:39 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to supply a crafted file that is subsequently processed by a vulnerable version of the c2pa Rust SDK, c2patool CLI, or @contentauth/c2pa-web JS SDK. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a locally-triggered, high-availability-impact flaw with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to the patched releases confirmed by Adobe advisory APSB26-111: Rust SDK to c2pa-v0.90.6 (update Cargo.toml dependency and re-lock), CLI tool to c2patool-v0.27.6 (replace binary or update via Cargo), and JS SDK to @contentauth/c2pa-web@0.12.1 (update package.json and re-lock npm/yarn). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in C2Pa

View all
CVE-2026-48290 HIGH
8.2 Jul 14

Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK

CVE-2026-48439 HIGH
7.5 Aug 11

Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
CVE-2026-48438 HIGH
7.5 Aug 11

Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
CVE-2026-48352 HIGH
7.5 Jul 14

Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on

CVE-2026-48351 HIGH
7.5 Jul 14

Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that

CVE-2026-48295 HIGH
7.5 Jul 14

Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
CVE-2026-48287 HIGH
7.4 Jul 14

Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
CVE-2026-48442 HIGH
7.1 Aug 11

Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
CVE-2026-48312 MEDIUM
6.8 Jul 14

Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
CVE-2026-48436 MEDIUM
6.5 Aug 11

Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
CVE-2026-48445 MEDIUM
6.2 Aug 11

Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
CVE-2026-48444 MEDIUM
6.2 Aug 11

Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-48387 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy