CVE-2026-47905: Adobe C2PA Resource Exhaustion Denial of Service Vulnerability

Technical summary

CVE-2026-47905 is an Uncontrolled Resource Consumption vulnerability (CWE-400) in Adobe's C2PA content credentials library. The flaw permits an attacker to exhaust system memory or compute resources by sending specially crafted inputs to the library without authentication or user interaction. The vulnerability exists in [email protected] and [email protected] and earlier versions. With a CVSS v3.1 score of 6.2 (MEDIUM), the attack vector is local, requires no privileges, and causes high availability impact while preserving confidentiality and integrity.

Business impact

Applications embedding C2PA for content authentication and credential management become susceptible to availability disruptions. A successful exploit could render dependent services unresponsive, affecting digital asset verification workflows, media authenticity verification pipelines, and any system relying on C2PA for tamper detection. Organizations using C2PA in production environments face operational risk if the library is exposed to untrusted input, whether through web services, content processing jobs, or integration points.

Affected systems

The vulnerability impacts Adobe C2PA and C2PA-Web libraries at version 0.80.1 and earlier for the core library, and 0.7.1 and earlier for the web variant. Any application or service that depends on these libraries for content credential processing is affected. This includes web applications, backend content verification systems, and desktop applications that bundle C2PA for authenticity checks.

Exploitability

The vulnerability requires local access but no authentication or user interaction, making it exploitable by any local process or user on the system. The attack surface is broad if C2PA is exposed through APIs, web services, or automated content processing pipelines that accept external input. However, the absence from the CISA Known Exploited Vulnerabilities (KEV) catalog indicates no confirmed active exploitation in the wild at this time.

Remediation

Upgrade Adobe C2PA and C2PA-Web libraries to versions newer than 0.80.1 and 0.7.1 respectively. Verify the specific patched versions in Adobe's security advisories. Additionally, implement input validation and rate limiting on any interfaces that accept content for C2PA credential processing. Where feasible, restrict C2PA processing to trusted or pre-validated content sources to minimize the attack surface.

Patch guidance

Check Adobe's security updates for C2PA and C2PA-Web. Update c2pa-web to a version greater than 0.7.1 and the core c2pa library to a version greater than 0.80.1. Consult the vendor advisory for specific patched version numbers and deployment procedures. Test patches in non-production environments before rolling out broadly, particularly for applications where C2PA is a critical component of content verification.

Detection guidance

Monitor for abnormal resource consumption (CPU, memory) in processes using C2PA, particularly those handling untrusted or external content. Implement logging and alerting on content processing pipeline errors and timeouts. Use application performance monitoring (APM) tools to detect sudden spikes in resource usage correlated with content credential processing. Review access logs for unusual patterns in content submission or processing requests that might indicate attack probing.

Why prioritize this

While the CVSS score is MEDIUM (6.2), prioritization should be elevated for organizations where C2PA is embedded in customer-facing or critical backend services. The no-interaction, no-authentication attack vector and high availability impact make this a concern for service reliability. The absence from the KEV catalog suggests emerging rather than actively exploited threats, providing a window for proactive patching before mass exploitation becomes common.

Risk score, explained

The CVSS v3.1 score of 6.2 reflects a medium-severity denial-of-service vulnerability with local attack vector. The score emphasizes high availability impact (A:H) but no confidentiality or integrity compromise. Organizations should map internal risk based on deployment context: a vulnerability in a library handling untrusted external content poses greater risk than one in tightly controlled internal-only systems. The local vector does not diminish risk for web services or APIs that expose the functionality.

Frequently asked questions