What is the CVSS score of CVE-2026-48439?

CVE-2026-48439 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of CAI Content Credentials are affected by CVE-2026-48439?

Adobe's Content Credentials SDK (affecting Rust c2pa, JavaScript/WebAssembly @contentauth/c2pa-web, and c2patool) contains a resource exhaustion vulnerability that allows unauthenticated remote…

How to fix or mitigate CVE-2026-48439?

Within 24 hours: audit all systems to identify applications and services using Adobe's c2pa Rust SDK, @contentauth/c2pa-web SDK, or c2patool across all versions prior to patched releases; document affected systems and their business criticality. Within 7 days: deploy rate limiting and request throttling on all API endpoints that process content credentials, implement Web Application Firewall rules to block resource-exhaustion attack patterns, and assess isolating credential verification functions behind request concurrency controls. Within 30 days: establish continuous monitoring for Adobe security advisories and patch releases, evaluate functionally equivalent alternative content credential solutions if Adobe's patching timeline is insufficient for risk tolerance, and execute load testing on affected systems under simulated attack conditions to quantify resource exhaustion thresholds.

CAI Content Credentials CVE-2026-48439

EUVD-2026-56560 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-08-11 psirt@adobe.com

GHSA-qjjr-945q-3x93

Denial Of Service Adobe C2Pa C2Pa Web C2Patool

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated parsing with no complexity barriers; impact is purely availability with no confidentiality or integrity exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:22 vuln.today

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.5

DescriptionCVE.org

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exhaust system resources and cause an application denial-of-service. Three distinct SDK components are affected: the Rust SDK (c2pa), the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), and the command-line tool (c2patool), all across their respective versions prior to the patched releases. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is trivially exploitable without authentication or user interaction.

Technical ContextAI

The CAI Content Credentials ecosystem implements the C2PA (Coalition for Content Provenance and Authenticity) open specification for embedding and verifying provenance metadata in digital media files. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), a root-cause class in which the software fails to enforce limits on the amount of resources it allocates or processes in response to externally-supplied input - typically triggered by parsing maliciously crafted media files with pathological metadata structures. Affected CPE-identified components span the Rust-native c2pa crate (≤0.90.5), the WebAssembly-compiled JavaScript SDK (@contentauth/c2pa-web ≤0.12.0), and the c2patool CLI (≤0.27.5). When these SDKs process a specially constructed C2PA-signed artifact, the parser can be induced to allocate unbounded memory or CPU cycles without a termination condition, starving legitimate workloads.

RemediationAI

Vendor-released patches are available for all three affected components. Upgrade the Rust SDK to c2pa-v0.90.6 or later, the JavaScript SDK to @contentauth/c2pa-web@0.12.1 or later, and the command-line tool to c2patool-v0.27.6 or later. Full details are in Adobe's security advisory APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. For environments where immediate patching is not feasible, compensating controls should include restricting which sources may submit media files for C2PA processing (allowlist trusted origins), enforcing upload size limits and request rate limits at the API gateway or CDN layer before files reach the SDK, and running the SDK in an isolated process or container with hard memory and CPU cgroup limits so resource exhaustion is contained and does not cascade to the host or co-located services.