CVE-2026-47905
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
CAI Content Credentials libraries ([email protected], c2pa-v0.80.1 and earlier) are vulnerable to uncontrolled resource consumption. An attacker can exhaust system resources, causing application denial of service without user interaction.
Risk Assessment
An attacker can remotely cause application unavailability, affecting service continuity.
Recommendation
Update CAI Content Credentials libraries to the latest patched versions.
Other vulnerabilities in CAI Content Credentials
See all- CVE-2026-76198Medium
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-76189Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71444Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71443High
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.
- CVE-2026-71442High
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation does not require user interaction.
- CVE-2026-71360High
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-71390Medium
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction.
- CVE-2026-71389Medium
CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- CVE-2026-48446Medium
CAI Content Credentials is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this to access sensitive files and directories outside the intended scope. Exploitation requires user interaction, such as visiting a malicious URL or interacting with a compromised web page.
- CVE-2026-48445Medium
CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this to crash the application. Exploitation does not require user interaction.
Original NVD description (English source)
CAI Content Credentials versions [email protected], c2pa-v0.80.1 and earlier are affected by an Uncontrolled Resource Consumption vulnerability. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.