# CVE-2026-47904: Adobe Content Credentials uncontrolled resource consumption

Source: https://junglewise.ai/threats/cve-2026-47904-adobe-content-credentials-uncontrolled-resource-consumption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-47904 · Severity: medium · CVSS 6.2 · Published 2026-06-09

Adobe Content Credentials, a tool used to verify the authenticity and origin of digital content, is affected by a flaw that allows for resource exhaustion. An attacker can exploit this to crash the application or make it unresponsive, leading to a denial-of-service. This impact prevents users from verifying the provenance of media, potentially disrupting workflows that rely on content authenticity.

Technologies: [Adobe Content Credentials (c2pa-v)](https://junglewise.ai/threats/technologies/c2pa-rs), [Adobe Content Credentials (c2pa-web)](https://junglewise.ai/threats/technologies/c2pa-web). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-47904 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47904 being exploited in the wild.

**How severe is CVE-2026-47904?** Medium severity, with a CVSS score of 6.2, published 9 June 2026.

**Which products and versions are affected?** Adobe Content Credentials (c2pa-v) 0.80.1 and earlier; Adobe Content Credentials (c2pa-web) 0.7.1 and earlier.

**Is there a fix for CVE-2026-47904?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47904 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-47904?** Check whether you run Adobe Content Credentials (c2pa-v) or Adobe Content Credentials (c2pa-web) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An uncontrolled resource consumption vulnerability (CWE-400) exists in the Adobe Content Authenticity Initiative (CAI) SDK. The flaw affects the c2pa-web and c2pa-v libraries, where improper handling of incoming data can lead to system resource exhaustion. The attack vector is classified as local, and exploitation does not require administrative privileges or user interaction. Successful exploitation results in a denial-of-service (DoS) condition for the affected application. Users are advised to update to the latest versions of the Content Authenticity SDK as referenced in Adobe security bulletin APSB26-61.

## Affected products

- Adobe Content Credentials (c2pa-web) 0.7.1 and earlier
- Adobe Content Credentials (c2pa-v) 0.80.1 and earlier

## Timeline

- 2026-06-09: advisory: Adobe published security bulletin APSB26-61
- 2026-06-09: disclosed: CVE-2026-47904 published to NVD

## References

- [https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html](https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-61.html)

## Related threats

- [Adobe CAI Content Credentials resource consumption in SDK](https://junglewise.ai/threats/cve-2026-47905-adobe-cai-content-credentials-resource-consumption-in-sdk)
- [Adobe CAI Content Credentials resource consumption in c2pa-web and c2pa-v](https://junglewise.ai/threats/cve-2026-47902-adobe-cai-content-credentials-resource-consumption-in-c2pa-web)
- [Adobe Content Credentials denial of service via improper input validation](https://junglewise.ai/threats/cve-2026-34712-adobe-content-credentials-denial-of-service-via-improper-input)