Adobe C2pa Web: 15 Vulnerabilities in CAI Content Credentials Disclosed Together
Adobe C2pa Web's CAI Content Credentials component is affected by a batch of 15 vulnerabilities disclosed on August 11, 2026, including DoS, path traversal, and security bypasses.
Key findings
- 15 vulnerabilities disclosed on August 11, 2026, for Adobe C2pa Web's CAI Content Credentials component.
- Vulnerabilities include denial-of-service, path traversal, security feature bypass, and SSRF.
- Several DoS vulnerabilities stem from integer overflows/underflows and resource consumption.
- Path traversal flaws allow for arbitrary file system reads.
- Security feature bypasses could lead to unauthorized write access.
- Exploitation varies from no user interaction to requiring user interaction with malicious links.
On August 11, 2026, a batch of 15 vulnerabilities was disclosed for Adobe Inc.'s C2pa Web product, specifically within the CAI Content Credentials component. These vulnerabilities, disclosed on the same day, span a range of severity from Medium to High, with potential impacts including denial-of-service, arbitrary file system reads, and security feature bypasses. The coordinated disclosure highlights several recurring vulnerability classes within the component.
Several vulnerabilities are related to improper input validation and resource management. CVE-2026-71390 and CVE-2026-48436, both rated Medium, are improper input validation flaws that could lead to security feature bypasses, potentially granting unauthorized write access. Similarly, CVE-2026-48437, also a Medium severity flaw, involves improper certificate validation, which could also result in a security feature bypass.
A significant portion of the disclosed vulnerabilities are denial-of-service (DoS) conditions. CVE-2026-71389 and CVE-2026-48435 are Integer Underflow vulnerabilities, while CVE-2026-48445, CVE-2026-48444, and CVE-2026-48387 are Integer Overflow or Wraparound vulnerabilities, all leading to application DoS. Additionally, CVE-2026-48443, CVE-2026-48439, and CVE-2026-48344 are Uncontrolled Resource Consumption vulnerabilities, also resulting in DoS. CVE-2026-48438, a High severity vulnerability, is a NULL Pointer Dereference that can crash the application.
Path traversal vulnerabilities, allowing for arbitrary file system reads, are also present. CVE-2026-48446, a Medium severity flaw, and CVE-2026-48442, a High severity flaw, both fall into this category, enabling attackers to access files and directories outside their intended scope.
Finally, CVE-2026-47922, a Medium severity Server-Side Request Forgery (SSRF) vulnerability, could lead to privilege escalation. This vulnerability requires user interaction, such as visiting a malicious URL.
The disclosed vulnerabilities affect various versions of CAI Content Credentials within the C2pa Web product. While specific patch details were not provided in the disclosure, users are advised to consult Adobe's official advisories for the latest information on affected versions and available updates. The coordinated disclosure of these 15 vulnerabilities underscores the importance of regular security audits and timely patching for Adobe's C2pa Web component.
The batch of vulnerabilities disclosed on August 11, 2026, for Adobe's C2pa Web product, specifically the CAI Content Credentials component, presents a range of risks including denial-of-service, arbitrary file system reads, and security feature bypasses. Users are strongly encouraged to review the specific CVE details and apply any available patches or mitigations provided by Adobe to protect against potential exploitation.
Key findings: • A batch of 15 vulnerabilities was disclosed on August 11, 2026, for Adobe's C2pa Web CAI Content Credentials component. • Vulnerabilities include denial-of-service (DoS) due to integer overflows/underflows and resource consumption. • Path traversal flaws (CVE-2026-48446, CVE-2026-48442) allow for arbitrary file system reads. • Security feature bypasses (CVE-2026-71390, CVE-2026-48436, CVE-2026-48437) could lead to unauthorized write access. • High severity vulnerabilities include path traversal (CVE-2026-48442) and NULL pointer dereference (CVE-2026-48438). • Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-47922) could lead to privilege escalation.