What is the CVSS score of EUVD-2026-44522?

EUVD-2026-44522 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Content Credentials are affected by EUVD-2026-44522?

Adobe's Content Credentials (C2PA) SDK ecosystem is vulnerable to unauthenticated remote denial-of-service attacks when processing attacker-supplied signed assets, affecting applications across Rust,…

How to fix or mitigate EUVD-2026-44522?

Within 24 hours: inventory all systems using Rust c2pa SDK, @contentauth/c2pa-web JavaScript library, and c2patool command-line utility; assess business criticality and restrict external access to services processing C2PA-signed assets; enable detailed application logging to detect exploitation attempts. Within 7 days: deploy strict input validation and rate-limiting controls on C2PA asset ingestion pipelines; implement Web Application Firewall rules targeting malformed C2PA cryptographic structures; consider disabling C2PA verification if operationally feasible. Within 30 days: monitor Adobe security advisories and CISA for patch releases; apply vendor patches immediately upon availability with pre-production security testing; conduct post-deployment validation of remediation effectiveness.

Content Credentials EUVD-2026-44522

| CVE-2026-48351 HIGH

Improper Input Validation (CWE-20)

2026-07-14 psirt@adobe.com

GHSA-73hf-p3jv-88p6

Denial Of Service C2Pa C2Pa Web C2Patool

7.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Untrusted media parsed over the network needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); DoS-only impact gives C:N/I:N/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:02 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that ingests attacker-supplied C2PA-signed assets. The flaw stems from improper input validation (CWE-20) in the Rust c2pa SDK, the @contentauth/c2pa-web JS SDK, and the c2patool command-line utility; exploitation requires no user interaction and no authentication (CVSS 7.5, A:H). No public exploit code has been identified and it is not in CISA KEV, though CISA's SSVC framework flags it as automatable, meaning a working exploit could be scaled easily.

Technical ContextAI

C2PA (Coalition for Content Provenance and Authenticity) is the open standard behind 'Content Credentials' - cryptographically signed provenance manifests embedded in images, video, and other media to attest to their origin and edit history. Adobe maintains the reference implementations: the Rust core SDK (cpe:2.3:a:adobe:c2pa), the Node.js/WASM web binding (cpe:2.3:a:adobe:c2pa-web), and the c2patool CLI (cpe:2.3:a:adobe:c2patool). The vulnerability is a CWE-20 Improper Input Validation defect in the manifest/asset parsing path: when the library reads a malformed or crafted C2PA structure it fails to validate the input safely and terminates abnormally (e.g., panic/unhandled error/resource exhaustion), producing an availability-only impact with no confidentiality or integrity effect (C:N/I:N/A:H).

RemediationAI

Vendor-released patches are available and are the primary fix: upgrade the Rust SDK to c2pa-v0.85.2 or later, the web SDK to @contentauth/c2pa-web@0.9.0 or later, and the CLI to c2patool-v0.26.65 or later, per Adobe advisory APSB26-80 (https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html). Because the fix touches shared parsing logic, update every deployed variant, including transitive dependencies that vendor the c2pa crate or WASM binding. Where immediate patching is not possible for a service that validates untrusted media, apply compensating controls: gate C2PA validation behind isolated, resource-limited worker processes or sandboxes that can be restarted so a crash does not take down the main service (trade-off: added latency and infrastructure); enforce strict upload size/type limits and rate-limiting on endpoints that trigger C2PA parsing to blunt automated crash attempts (trade-off: may reject some legitimate large assets); and defer or disable automatic Content Credentials validation on untrusted user uploads until patched (trade-off: temporary loss of provenance verification).