EUVD-2026-100738
GHSA-pgc8-xrpv-pcpp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SDK-backed parsing endpoint
-
DeliverySubmit crafted Content Credentials asset
-
ExploitTrigger uncontrolled resource consumption
-
ExecutionExhaust CPU/memory
-
ImpactApplication denial-of-service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions stated - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation with no user interaction against the CAI Content Credentials SDK as used by an affected application. The required precondition is that the vulnerable SDK is reachable in a path that parses or verifies attacker-supplied Content Credentials data; the advisory does not name a specific feature flag or configuration setting. The principal limiting factor is exposure: deployments that do not expose SDK-backed parsing to untrusted input (e.g., offline/desktop-only or internally-trusted pipelines) face substantially lower real-world risk, and impact is confined to availability (no data disclosure or modification). |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated availability-only vulnerability - all signals point to a pure denial-of-service with no confidentiality or integrity impact. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the risk assessment rests entirely on the theoretical CVSS profile plus the vendor (Adobe PSIRT) advisory. This is a case where a HIGH CVSS does not automatically equal an urgent operational priority: resource-exhaustion DoS flaws (CWE-400) are serious for availability-sensitive services but cannot be used for code execution, data theft, or lateral movement. The practical risk is strongly modulated by deployment context - a Content Credentials SDK processing attacker-supplied media server-side is far more exposed than an offline/desktop integration. No conflicting signals were detected between the vector and the description (both agree on remote, unauthenticated, availability impact); the main gap is the absence of exploitation-probability telemetry (EPSS) and any statement of in-the-wild activity, so prioritization should lean on exposure of the affected integration rather than on exploitation evidence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker submits specially crafted content (e.g., a malformed or maliciously structured media asset carrying Content Credentials metadata) to a service that uses the CAI Content Credentials SDK to parse or verify it. The parsing triggers uncontrolled resource consumption (CPU/memory), exhausting system resources and rendering the application unresponsive. No public exploit identified at time of analysis, and because AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial-of-service in the CAI Content Credentials SDK allows remote unauthenticated attackers to exhaust system resources by supplying crafted Content Credentials data to an application that parses or verifies it. The issue is availability-only (CVSS 3.1 7.5, CWE-400) with no confidentiality or integrity impact, and no public exploit has been identified at time of analysis. Deployments that do not expose SDK-backed parsing to untrusted input face substantially lower real-world risk.
RemediationAI
Apply the fix referenced in Adobe advisory APSB26-163; the provided data does not include an exact patched SDK version, so verify the fixed build from Adobe before deployment. If immediate patching is not possible, reduce exposure by disabling or restricting SDK-backed parsing and verification of untrusted Content Credentials, enforcing strict input size and processing-time limits, rate limiting, and running parsing in an isolated low-privilege worker or container with CPU and memory quotas; these controls may reject or delay legitimate large or malformed credentials and can break workflows that depend on automated verification. Monitor for repeated CPU, memory, or thread exhaustion against endpoints that invoke the SDK and use the advisory as the authoritative source for vendor-specific workarounds; patch availability is indicated by the vendor advisory but exact fixed versions are not specified in the provided input.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Content Credentials refers to Adobe's Content Authenticity Initiative (CAI) implementation for provenance and authenticity metadata, and the vulnerable component is the Content Credentials SDK that applications use to parse or verify such data. CWE-400 (Uncontrolled Resource Consumption) indicates the SDK can be driven to consume excessive CPU, memory, threads, or other resources when processing specially crafted Content Credentials input. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes remote, low-complexity, unauthenticated exploitation with no user interaction, and no CPE strings or exact affected SDK versions were supplied in the provided data, so the root cause is best understood as missing resource bounds in credential parsing or verification logic.
Know when C2Pa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remotely reachable parsing of untrusted input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); resource exhaustion yields availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Executive ViewAI
The CAI Content Credentials SDK contains a high-severity resource-exhaustion flaw that lets remote attackers degrade or halt applications that parse or verify Content Credentials data, with no confidentiality or integrity loss but a clear availability risk. Organizations that accept untrusted or externally sourced Content Credentials into SDK-backed workflows are most exposed - for example, media ingestion pipelines, public upload or verification services, and customer-facing content validation tools. Because no vendor patch is currently available, leadership should treat this as a resilience and capacity-management issue requiring interim controls until a fix ships.
No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis. Interim mitigations: restrict or disable SDK-backed parsing and verification for untrusted input; enforce strict payload size and complexity limits; apply CPU, memory, thread, and timeout quotas to parsing processes; rate-limit and cap connections on public-facing endpoints; run the SDK in an isolated, resource-bounded service to prevent denial-of-service from affecting other workloads; add monitoring and alerting for resource saturation and service latency.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Server-side request forgery in Adobe Content Credentials (CAI Content Credentials SDK) allows unauthenticated remote att
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resou
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaus
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated r
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthori
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted i
Integer overflow (CWE-190) in the CAI Content Credentials SDK lets unauthenticated remote attackers crash applications t
Denial of service in the CAI Content Credentials SDK allows remote, unauthenticated attackers to exhaust system resource
Application denial-of-service in the Adobe CAI Content Credentials SDK lets unauthenticated remote attackers exhaust sys
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Exploit-DB