EUVD-2026-56284
GHSA-pm7w-94qj-7q86
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Local vector matches CLI/SDK invocation model; PR:N because unprivileged users can run c2patool; A:H for full process crash; no confidentiality or integrity impact applies.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - spanning the c2patool CLI (≤v0.27.5), Rust SDK c2pa (≤v0.90.5), and JavaScript SDK @contentauth/c2pa-web (≤v0.12.0) - allows a local attacker without elevated privileges to exhaust system resources and cause an application denial-of-service. The vulnerability does not require user interaction, lowering the bar for exploitation in automated pipelines. Adobe has released patches across all three components via advisory APSB26-111, and no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
The affected software implements the C2PA (Coalition for Content Provenance and Authenticity) open standard for digital content provenance and credential metadata. Three distinct components share this flaw: c2patool, a Rust-based command-line utility for signing and verifying content credentials; c2pa, the underlying Rust SDK; and @contentauth/c2pa-web, a JavaScript/WebAssembly SDK for browser and Node.js environments. CWE-400 (Uncontrolled Resource Consumption) indicates the implementation fails to enforce bounds on resource usage - likely memory allocation or CPU cycles - when parsing or processing C2PA manifests or credential payloads. The CVSS vector AV:L confirms that triggering the flaw requires local interaction (e.g., supplying a crafted file to the CLI or a consuming application), with no privilege escalation required (PR:N), consistent with unprivileged local users or automated content-processing pipelines invoking these tools.
RemediationAI
The primary fix is to upgrade all affected Content Credentials components immediately: c2patool to v0.27.6, the Rust SDK c2pa to v0.90.6, and the JavaScript SDK @contentauth/c2pa-web to 0.12.1. Official patch details are in Adobe advisory APSB26-111 at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-111.html. For environments where immediate patching is not feasible, apply OS-level resource limits to any process invoking c2patool or an SDK-consuming application - for example, ulimit -v and ulimit -t on Linux to cap virtual memory and CPU time per process, or Windows Job Objects with memory and CPU limits. This limits blast radius but may cause legitimate large-manifest processing to fail, requiring workload-specific tuning. Additionally, validate and size-cap C2PA manifest files at the pipeline ingestion boundary before they reach the SDK, rejecting inputs exceeding a defined threshold. Restricting which local users or service accounts can invoke these tools provides further defense-in-depth.
Server-Side Request Forgery in Adobe's C2PA (Content Credentials) SDK family - the Rust SDK (c2pa), the Node.js web SDK
Uncontrolled resource consumption in Adobe's CAI Content Credentials SDK enables remote unauthenticated attackers to exh
Null pointer dereference in Adobe's Content Credentials SDKs (Rust SDK ≤c2pa-v0.90.5, JS SDK ≤@contentauth/c2pa-web@0.12
Denial-of-service in Adobe's C2PA / Content Credentials SDKs allows a remote attacker to crash any application built on
Denial-of-service in Adobe's Content Credentials (C2PA) SDK ecosystem lets a remote attacker crash any application that
Credential disclosure in Adobe's CAI Content Credentials (C2PA) tooling - spanning the Rust SDK (c2pa ≤0.84.0), the JS S
Arbitrary code execution in Adobe's Content Authenticity (CAI) Content Credentials tooling — the c2pa Rust SDK (≤0.84.0)
Path traversal in Adobe's Content Credentials toolkit - spanning the c2patool CLI, the c2pa Rust SDK, and the @contentau
Security feature bypass in Adobe's Content Credentials (C2PA) SDKs - the Rust SDK (≤0.84.0), JavaScript SDK (≤0.7.0), an
Improper input validation across Adobe's Content Credentials JS SDK, Rust SDK, and command-line tool allows a remote una
Integer overflow in Adobe's CAI Content Credentials SDK family (Rust, JavaScript, and CLI) allows a local attacker to cr
Integer overflow in Adobe's Content Credentials ecosystem - spanning the Rust SDK (c2pa ≤ v0.90.5), JavaScript SDK (@con
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today