What is the CVSS score of EUVD-2026-56278?

EUVD-2026-56278 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Content Credentials EUVD-2026-56278

| CVE-2026-48387 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-08-11 psirt@adobe.com

GHSA-7f7v-xhq6-jf8p

Denial Of Service Integer Overflow Adobe C2Pa C2Pa Web C2Patool

6.2

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Local file delivery triggers the overflow without privileges or interaction; impact is availability-only with no scope change.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 23:39 vuln.today

DescriptionCVE.org

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

AnalysisAI

Integer overflow in Adobe's Content Credentials SDK and CLI toolchain crashes the application when processing crafted input, resulting in a denial-of-service condition. Affected components span the Rust SDK (c2pa), the command-line tool (c2patool), and the JavaScript/WebAssembly SDK (@contentauth/c2pa-web), all at versions prior to their respective patch releases. No public exploit has been identified at time of analysis, and SSVC assesses exploitation as none with non-automatable delivery.

Technical ContextAI

CWE-190 (Integer Overflow or Wraparound) describes a class of bug where arithmetic on bounded integer types exceeds their representable range, causing the value to wrap to an unexpected result - typically zero or a very large number - that corrupts size calculations, loop bounds, or memory allocation parameters. In media-authenticity libraries like the c2pa Rust SDK and c2pa-web JS/WASM SDK, such overflows most likely occur during parsing of Content Credentials manifests embedded in image or video files, where attacker-controlled length fields or record counts are used in arithmetic without overflow checks. The c2patool CLI wraps the Rust SDK as a command-line interface, inheriting the same flaw. Exact affected versions per EUVD: Rust SDK ≤ c2pa-v0.90.5, CLI ≤ c2patool-v0.27.5, JS SDK ≤ @contentauth/c2pa-web@0.12.0.

RemediationAI

Upgrade to the patched releases confirmed by Adobe advisory APSB26-111: Rust SDK to c2pa-v0.90.6 (update Cargo.toml dependency and re-lock), CLI tool to c2patool-v0.27.6 (replace binary or update via Cargo), and JS SDK to @contentauth/c2pa-web@0.12.1 (update package.json and re-lock npm/yarn). Full advisory is at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. As a compensating control for automated pipelines unable to patch immediately, restrict the file sources processed by c2patool or the SDK to trusted, internally-generated content only - this eliminates the attacker's ability to deliver a crafted file. Do not expose c2patool or SDK-based processing endpoints to untrusted input without patching. Note: restricting input sources requires application-level allowlisting and does not fix the underlying integer overflow.