What is the CVSS score of EUVD-2026-56273?

EUVD-2026-56273 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials SDK EUVD-2026-56273

| CVE-2026-48435 MEDIUM

Integer Underflow (CWE-191)

2026-08-11 psirt@adobe.com

GHSA-99xw-7776-rq87

Denial Of Service Integer Overflow Adobe C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local vector because exploitation requires a crafted file to reach the parser; PR:N as no privileges needed post-delivery; availability-only impact with no confidentiality or integrity loss.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:36 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer underflow in Adobe's Content Credentials SDK crashes any application that parses a specially crafted C2PA manifest file, producing a denial-of-service condition. The Rust crate (c2pa ≤0.90.5), JavaScript/WASM package (@contentauth/c2pa-web ≤0.12.0), and CLI tool (c2patool ≤0.27.5) are all affected, with patched releases confirmed by Adobe advisory APSB26-111. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is highest in automated media ingestion pipelines that validate C2PA provenance on user-supplied files.

Technical ContextAI

Content Credentials implements the C2PA (Coalition for Content Provenance and Authenticity) open standard, which embeds cryptographic provenance manifests inside media files. CWE-191 (Integer Underflow/Wraparound) arises when a size or length value derived from parsing the manifest is decremented below zero - or below the minimum of an unsigned integer type - causing it to wrap to a very large positive value. That corrupt value is subsequently used in memory allocation or buffer-slicing logic, typically producing a panic or an invalid memory access that terminates the process. The vulnerability spans three distinct release artifacts maintained under the Adobe contentauth organization: the Rust crate c2pa, the npm/WASM package @contentauth/c2pa-web, and the c2patool command-line binary, all of which share C2PA manifest parsing logic.

RemediationAI

Upgrade immediately to the patched versions confirmed by Adobe APSB26-111: Rust SDK to c2pa-v0.90.6 (via Cargo.toml update), JavaScript SDK to @contentauth/c2pa-web@0.12.1 (via npm/yarn upgrade), and CLI tool to c2patool-v0.27.6 (via direct binary replacement or package manager). Full advisory is at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. Where immediate patching is not feasible, restrict C2PA file parsing to internally generated or cryptographically pre-screened content only - trade-off: third-party provenance validation is disabled. Additionally, run SDK parsing workers in isolated containers or processes with watchdog-based auto-restart so that a crash does not take down the broader service; this limits DoS impact but does not prevent individual request failures.