EUVD-2026-65622
GHSA-3fhm-9gfg-4v5r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable parser, no authentication or interaction required; impact is availability-only with no confidentiality or integrity effect, matching the DoS-only description.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionCVE.org
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
AnalysisAI
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication or user interaction is required (CVSS PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 score accurately reflects a medium-high risk for availability: the attack is network-reachable, requires no authentication, no special configuration, and no user interaction, making it straightforward to trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a specially crafted C2PA manifest or Content Credentials payload - possibly a deeply nested, recursive, or artificially inflated structure - to an internet-accessible service running the vulnerable Rust SDK or c2pa_tool. The parser processes the malicious input without enforcing resource bounds, consuming available memory or CPU until the application becomes unresponsive and legitimate requests fail. … |
| Remediation | Apply the vendor-supplied patch documented in Adobe Security Bulletin APSB26-110, available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and applications using Adobe Content Credentials tools or c2pa_tool components and implement network-level rate limiting to constrain resource consumption from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Crede
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processin
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today