CVE-2026-47902
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Uncontrolled resource consumption vulnerability in CAI Content Credentials library ([email protected], c2pa-v0.80.1 and earlier). An attacker can exhaust system resources, causing a denial of service (DoS). Exploitation does not require user interaction.
Risk Assessment
The risk is the potential for remote system overload, leading to application unavailability for users.
Recommendation
It is recommended to update the CAI Content Credentials library to the latest patched version.
Other vulnerabilities in CAI Content Credentials
See all- CVE-2026-76198Medium
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-76189Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71444Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71443High
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.
- CVE-2026-71442High
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.
- CVE-2026-71360High
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71390Medium
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
- CVE-2026-71389Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-48446Medium
CAI Content Credentials is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.
- CVE-2026-48445Medium
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.
Original NVD description (English source)
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

