CVE-2026-48351

CAI Content Credentials | Improper Input Validation (CWE-20)

Published Jul 14, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Analysis

Technical impact

The CAI Content Credentials components contain an Improper Input Validation flaw identified as CWE‑20 that allows an attacker to craft malicious input and cause the application to crash. The resulting crash ends the service, leading to a denial‑of‑service condition that cannot be recovered without application restart.

Affected Systems

Adobe’s Content Credentials Command‑Line Tool, the JavaScript SDK, and the Rust SDK are impacted. The advisory does not list affected versions, so any deployment of these components may be susceptible until a patch is applied.

Risk and Exploitability

The CVSS score of 7.5 marks this vulnerability as high severity. An EPSS score of < 1 % indicates that exploitation is considered unlikely, but it is still possible. No active exploits are listed in the KEV catalog. The vulnerability does not require user interaction, making it potentially exploitable remotely by sending crafted input to the affected components.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Content Credentials Rust SDK

unaffected

Version	Status	Constraints
`0`	affected	≤ c2pa-v0.84.0
`c2pa-v0.85.2`	unaffected	—

Adobe

Content Credentials Command-Line Tool

unaffected

Version	Status	Constraints
`0`	affected	≤ c2patool-v0.16.5
`c2patool-v0.26.65`	unaffected	—

Adobe

Content Credentials JS SDK

unaffected

Version	Status	Constraints
`0`	affected	≤ @contentauth/c2pa-web@0.7.0
`@contentauth/c2pa-web@0.9.0`	unaffected	—

Configuration 1 [-]

AND

OR	cpe:2.3:a:adobe:c2pa::::::rust::*
	cpe:2.3:a:adobe:c2pa-web::::::node.js::*
	cpe:2.3:a:adobe:c2patool::::::::

OR	cpe:2.3:o:apple:iphone_os:-:::::::*
	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:google:android:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Adobe

Content Credentials Command-line Tool

Version	Status	Scheme	Platform
`[0,c2patool-v0.16.5]`	affected	generic	—
`c2patool-v0.26.65`	unaffected	generic	—

Adobe

Content Credentials Js Sdk

Version	Status	Scheme	Platform
`[0,@contentauth/c2pa-web@0.7.0]`	affected	generic	—
`@contentauth/c2pa-web@0.9.0`	unaffected	generic	—

Adobe

Content Credentials Rust Sdk

Version	Status	Scheme	Platform
`[0,c2pa-v0.84.0]`	affected	generic	—
`c2pa-v0.85.2`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Adobe Content Credentials Command‑Line Tool, JS SDK, and Rust SDK to the latest versions available in the Adobe Security Advisory.
Add strict input validation in any code that processes data for the Content Credentials components, ensuring only expected formats are accepted.
Restrict exposure of the Content Credentials services to trusted networks or environments, using firewall rules or role‑based access controls to limit who can send input to the vulnerable components.

Generated by OpenCVE AI on July 31, 2026 at 04:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.927% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html

History

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk
Vendors & Products		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk

Jul 15, 2026 12:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
Title		CAI Content Credentials \| Improper Input Validation (CWE-20)
Weaknesses		CWE-20
References		https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`