Is CVE-2026-47903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47903 being exploited in the wild.

How severe is CVE-2026-47903?

Medium severity, with a CVSS score of 6.2, published 9 June 2026.

Which products and versions are affected?

Adobe Content Authenticity SDK (c2pa-rust) 0.80.1 and earlier; Adobe Content Authenticity SDK (c2pa-web) 0.7.1 and earlier.

Is there a fix for CVE-2026-47903?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47903 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-47903?

Check whether you run Adobe Content Authenticity SDK (c2pa-rust) or Adobe Content Authenticity SDK (c2pa-web) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47903: Adobe Content Authenticity SDK improper input validation

CVE-2026-47903 · Severity: medium · CVSS 6.2 · Published 2026-06-09

Adobe Content Credentials, a tool used to verify the origin and history of digital content, is affected by a flaw that can cause applications using it to crash. An attacker could exploit this to disrupt services or disable the authenticity verification features of a website or application. This could lead to temporary outages or the inability for users to trust the digital media they are viewing.

Technologies: Adobe Content Authenticity SDK (c2pa-web). Vendors: Adobe.

Quick answers

Is CVE-2026-47903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47903 being exploited in the wild.
How severe is CVE-2026-47903?: Medium severity, with a CVSS score of 6.2, published 9 June 2026.
Which products and versions are affected?: Adobe Content Authenticity SDK (c2pa-rust) 0.80.1 and earlier; Adobe Content Authenticity SDK (c2pa-web) 0.7.1 and earlier.
Is there a fix for CVE-2026-47903?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47903 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-47903?: Check whether you run Adobe Content Authenticity SDK (c2pa-rust) or Adobe Content Authenticity SDK (c2pa-web) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper input validation vulnerability (CWE-20) exists in the Adobe Content Authenticity Initiative (CAI) SDKs, specifically affecting the c2pa-web and c2pa-rust implementations. The flaw allows an attacker to provide specially crafted input that causes the application to crash, resulting in a denial-of-service (DoS). The attack vector is classified as local, but notably requires no prior authentication or user interaction to trigger the crash. Affected versions include c2pa-web at or below 0.7.1 and c2pa-rust at or below 0.80.1. Users are advised to update to the latest versions provided by Adobe to mitigate this risk.

Affected products

Adobe Content Authenticity SDK (c2pa-web) 0.7.1 and earlier
Adobe Content Authenticity SDK (c2pa-rust) 0.80.1 and earlier

Timeline

2026-06-09: disclosed
2026-06-09: advisory

References

https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.