CVE-2026-48357

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published Jul 14, 2026 CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Description

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Analysis

Technical impact

Uncontrolled Resource Consumption in Adobe Content Credentials allows an attacker to exhaust system resources not require user interaction and is characterized by CWE-400. Attackers can trigger excessive memory, CPU, or disk usage, leading to degraded application performance or complete unavailability.

Affected Systems

Adobe Content Credentials Command‑Line Tool, Adobe Content Credentials JS SDK, and Adobe Content Credentials Rust SDK are impacted. No specific versions are listed, so all.

Risk and Exploitability

The CVSS score moderate severity. The EPSS score of less than 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, likely through interfaces exposed by the SDKs or command‑line tool, and it can be carried out without any user interaction, meaning an external threat actor could trigger the denial‑of‑service on the target system.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Content Credentials Rust SDK

unaffected

Version	Status	Constraints
`0`	affected	≤ c2pa-v0.84.0
`c2pa-v0.85.2`	unaffected	—

Adobe

Content Credentials Command-Line Tool

unaffected

Version	Status	Constraints
`0`	affected	≤ c2patool-v0.16.5
`c2patool-v0.26.65`	unaffected	—

Adobe

Content Credentials JS SDK

unaffected

Version	Status	Constraints
`0`	affected	≤ @contentauth/c2pa-web@0.7.0
`@contentauth/c2pa-web@0.9.0`	unaffected	—

Configuration 1 [-]

AND

OR	cpe:2.3:a:adobe:c2pa::::::rust::*
	cpe:2.3:a:adobe:c2pa-web::::::node.js::*
	cpe:2.3:a:adobe:c2patool::::::::

OR	cpe:2.3:o:apple:iphone_os:-:::::::*
	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:google:android:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

No data.

Vendor Product Versions

Adobe

Content Credentials Command-line Tool

Version	Status	Scheme	Platform
`[0,c2patool-v0.16.5]`	affected	generic	—
`[c2patool-v0.26.65,c2patool-v0.26.65]`	unaffected	generic	—

Adobe

Content Credentials Js Sdk

Version	Status	Scheme	Platform
`[0,@contentauth/c2pa-web@0.7.0]`	affected	generic	—
`[@contentauth/c2pa-web@0.9.0,@contentauth/c2pa-web@0.9.0]`	unaffected	generic	—

Adobe

Content Credentials Rust Sdk

Version	Status	Scheme	Platform
`[0,c2pa-v0.84.0]`	affected	generic	—
`[c2pa-v0.85.2,c2pa-v0.85.2]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Adobe Content Credentials patch for the command‑line tool, JS SDK, or Rust SDK as released by Adobe.
Configure operating‑system resource limits or rate‑limiting on the affected services to mitigate the impact of an attack.
Monitor CPU, memory, and disk usage for the affected components to detect and respond to abnormal consumption patterns promptly.

Generated by OpenCVE AI on July 31, 2026 at 04:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.259% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html

History

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk
Vendors & Products		Adobe Adobe content Credentials Command-line Tool Adobe content Credentials Js Sdk Adobe content Credentials Rust Sdk

Jul 15, 2026 12:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 9:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Title		CAI Content Credentials \| Uncontrolled Resource Consumption (CWE-400)
Weaknesses		CWE-400
References		https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-80.html
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`