What is the CVSS score of CVE-2026-48445?

CVE-2026-48445 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials CVE-2026-48445

EUVD-2026-56279 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-08-11 psirt@adobe.com

GHSA-3xrw-25vc-8x62

Denial Of Service Integer Overflow Adobe C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector because crafted input must be delivered on-host; PR:N as no OS-level privileges needed to pass a file to the tool; only availability impacted via crash.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:33 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to crash the application, producing a denial-of-service condition. All three components - the Rust c2pa crate, the JS c2pa-web package, and the c2patool command-line utility - share the same CWE-190 root cause and are affected up to their respective boundary versions. No public exploit code or active exploitation has been identified; Adobe has released patched versions for all three components per advisory APSB26-111.

Technical ContextAI

The C2PA (Coalition for Content Provenance and Authenticity) standard defines how digital media assets embed cryptographically-signed provenance metadata. Adobe's CAI Content Credentials SDK implements this standard in three delivery vehicles: a Rust library (c2pa crate), a WebAssembly/JavaScript SDK (@contentauth/c2pa-web), and a standalone command-line tool (c2patool). CWE-190 (Integer Overflow or Wraparound) describes a class of defects where arithmetic on integer types exceeds the representable range, producing an unexpected wrapped value. In this context the overflow likely occurs during parsing or size computation of crafted C2PA manifest data, causing the application to encounter an invalid state and terminate. The local attack vector (AV:L) indicates the triggering input must be introduced via the local filesystem or stdin rather than a network interface.

RemediationAI

Upgrade to the vendor-patched versions released by Adobe: Rust SDK users should update to c2pa-v0.90.6 via Cargo; JavaScript SDK users should update to @contentauth/c2pa-web@0.12.1 via npm or yarn; CLI tool users should update c2patool to c2patool-v0.27.6. All patched versions are confirmed in Adobe advisory APSB26-111 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html). If immediate patching is not possible and the tools are used in automated pipelines processing untrusted content, a compensating control is to sandbox or containerize the invocation and limit input to trusted sources - this reduces the blast radius of a crash to the sandboxed process rather than the broader host. Note that sandboxing does not prevent the DoS condition itself, only limits its scope.