What is the CVSS score of CVE-2026-48443?

CVE-2026-48443 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials CVE-2026-48443

EUVD-2026-56283 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-08-11 psirt@adobe.com

GHSA-w3qh-4jwv-993v

Denial Of Service Adobe C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local file-based trigger requires no privileges or user interaction; impact is availability-only with no scope change beyond the processing application.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:34 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Uncontrolled resource consumption in Adobe's CAI Content Credentials ecosystem (c2patool CLI, Rust SDK, and JS SDK) allows a local attacker to trigger application denial-of-service by supplying crafted input that exhausts system resources. Three distinct release artifacts are affected: the c2patool command-line utility, the c2pa Rust crate, and the @contentauth/c2pa-web JavaScript SDK, all patched in a coordinated Adobe PSIRT disclosure (APSB26-111). No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as 'none' with non-automatable attack conditions.

Technical ContextAI

The Coalition for Content Provenance and Authenticity (C2PA) standard embeds cryptographically signed manifests into media assets to establish provenance. Adobe's CAI Content Credentials software implements C2PA parsing and validation across three release artifacts: the c2patool command-line binary (Rust), the c2pa Rust SDK crate, and the @contentauth/c2pa-web JavaScript/WebAssembly SDK. CWE-400 (Uncontrolled Resource Consumption) indicates that the parsing or validation logic fails to bound memory allocation, iteration depth, or processing time when handling specially constructed C2PA manifests or media files, enabling an attacker-controlled input to drive resource usage to exhaustion. The local attack vector (AV:L) is consistent with a file-based trigger: the attacker provides a crafted asset to the tool or SDK, rather than exploiting a network-exposed service.

RemediationAI

Upgrade to the patched versions released by Adobe under advisory APSB26-111 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html): c2patool CLI to v0.27.6, the c2pa Rust crate to v0.90.6, and the @contentauth/c2pa-web JS SDK to @0.12.1. For teams unable to upgrade immediately, a targeted compensating control is to validate and size-limit C2PA asset inputs before passing them to the SDK - reject files exceeding a defined byte threshold or manifest nesting depth. This trades off support for unusually large legitimate manifests. In automated ingestion pipelines, run the c2pa processing step in an isolated worker process with OS-level memory and CPU quotas (e.g., Linux cgroups) so a DoS condition cannot cascade to the host application. This does not fix the vulnerability but contains blast radius.