CVE-2026-47904: CAI Content Credentials DoS Vulnerability

CVE-2026-47904 Overview

CVE-2026-47904 affects Adobe's Content Authenticity Initiative (CAI) Content Credentials SDK. The vulnerability impacts c2pa-web@0.7.1, c2pa-v0.80.1, and earlier versions. The flaw is classified as Uncontrolled Resource Consumption [CWE-400]. An attacker with local access can exhaust system resources and trigger a denial-of-service condition in the application. Exploitation does not require user interaction or authentication. Adobe published the security advisory APSB26-61 to address the issue.

Critical Impact
A local attacker can trigger application-level denial-of-service by exhausting system resources processing C2PA Content Credentials, with no user interaction required.

Affected Products

Adobe CAI Content Credentials c2pa-web@0.7.1
Adobe CAI Content Credentials c2pa-v0.80.1
Earlier versions of the CAI Content Credentials SDK

Discovery Timeline

2026-06-09 - CVE-2026-47904 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-47904

Vulnerability Analysis

The vulnerability resides in the Coalition for Content Provenance and Authenticity (C2PA) parsing logic of Adobe's CAI Content Credentials SDK. The library parses manifests embedded in media assets to verify content provenance. An Uncontrolled Resource Consumption flaw [CWE-400] allows attacker-supplied input to drive the parser into unbounded resource use. Processing a crafted manifest causes excessive CPU, memory, or related resource allocation. The result is application unavailability for legitimate workloads.

Root Cause

The SDK fails to enforce bounds on resource allocation during manifest parsing and validation. The component does not constrain the size, depth, or iteration count of structures it processes. Inputs that appear well-formed can therefore trigger pathological resource use within the c2pa library code paths.

Attack Vector

Exploitation requires local access to the system or application that consumes Content Credentials data. An attacker supplies a malformed or oversized C2PA manifest to the SDK. The SDK processes the input and exhausts available resources. The integrity and confidentiality of data remain unaffected, but the affected application becomes unresponsive. Refer to the Adobe Security Update Advisory APSB26-61 for vendor-specific technical context.

Detection Methods for CVE-2026-47904

Indicators of Compromise

Sudden spikes in CPU or memory utilization by processes linked to the c2pa-web or c2pa libraries.
Application hangs or crashes correlated with ingestion of media files containing C2PA manifests.
Repeated parsing errors or timeouts emitted by Content Credentials validation routines.

Detection Strategies

Monitor process-level resource consumption for applications that embed the CAI Content Credentials SDK.
Inspect application logs for unhandled exceptions or extended processing times in C2PA manifest validation.
Baseline normal manifest sizes and flag inputs that exceed expected thresholds.

Monitoring Recommendations

Enable resource quota alerts on hosts running services that process user-supplied media with Content Credentials.
Forward application telemetry to a centralized log platform for correlation across ingestion failures.
Track the version of the CAI Content Credentials SDK deployed across endpoints and build pipelines.

How to Mitigate CVE-2026-47904

Immediate Actions Required

Upgrade the CAI Content Credentials SDK to a version later than c2pa-web@0.7.1 and c2pa-v0.80.1 as specified in Adobe advisory APSB26-61.
Inventory all applications and services that bundle the c2pa library, including build artifacts and container images.
Restrict local access to systems that process untrusted Content Credentials data.

Patch Information

Adobe addressed the vulnerability in the security update documented in Adobe Security Update Advisory APSB26-61. Administrators should review the advisory for fixed version identifiers and apply the corresponding SDK update to all affected deployments.

Workarounds

Validate and constrain the size of C2PA manifests before passing them to the SDK.
Run Content Credentials processing in isolated processes with enforced CPU and memory limits.
Disable automatic Content Credentials validation on untrusted inputs until the patched SDK is deployed.

bash

# Configuration example: apply resource limits to the C2PA processing service
systemd-run --scope -p MemoryMax=512M -p CPUQuota=50% \
  /usr/local/bin/c2pa-service --input /var/lib/c2pa/incoming