Is CVE-2026-118484 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118484 being exploited in the wild.

How severe is CVE-2026-118484?

Medium severity, with a CVSS score of 6.5, published 10 November 2026.

Which products and versions are affected?

Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier; Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier.

Is there a fix for CVE-2026-118484?

Yes: fixed in Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118484 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118484?

Check whether you run Adobe C2PA Tool (c2patool) or Adobe Content Credentials Rust SDK (c2pa) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118484: Adobe Content Credentials SDK improper input validation security feature bypass

CVE-2026-118484 · Severity: medium · CVSS 6.5 · Published 2026-11-10

Adobe Content Credentials SDK, used for managing digital authenticity and provenance of media, is affected by an improper input validation vulnerability that allows attackers to bypass security features. An attacker can exploit this issue by tricking a user into visiting a malicious URL or webpage, potentially allowing unauthorized modification of content credentials or authentication records. This could lead to forged or tampered media being presented as authentic.

Technologies: Adobe C2PA Tool (c2patool), Adobe Content Credentials Rust SDK (c2pa). Vendors: Adobe.

Quick answers

Is CVE-2026-118484 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118484 being exploited in the wild.
How severe is CVE-2026-118484?: Medium severity, with a CVSS score of 6.5, published 10 November 2026.
Which products and versions are affected?: Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier; Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier.
Is there a fix for CVE-2026-118484?: Yes: fixed in Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118484 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118484?: Check whether you run Adobe C2PA Tool (c2patool) or Adobe Content Credentials Rust SDK (c2pa) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Content Credentials Rust SDK c2pa-v0.91.11, C2PA Tool c2patool-v0.28.6

Technical details

CVE-2026-118484 is an improper input validation flaw (CWE-20) in Adobe Content Credentials Rust SDK that permits security feature bypass with a CVSS v3.1 score of 6.5. The vulnerability requires user interaction (visiting a malicious URL) and network-based attack vector, allowing attackers to gain unauthorized write access to security-critical data. The vulnerability is fixed in Content Credentials Rust SDK c2pa-v0.91.11 and C2PA Tool c2patool-v0.28.6.

Affected products

Adobe Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier
Adobe C2PA Tool (c2patool) c2patool-v0.28.5 and earlier

Timeline

2026-11-10: disclosed

References

https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.