EUVD-2026-65622
GHSA-3fhm-9gfg-4v5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted C2PA manifest payload
-
DeliveryParser processes unbounded structure
-
ExploitExhaust system memory or CPU
-
ExecutionApplication becomes unresponsive
-
ImpactDenial-of-service for legitimate users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or user interaction is required (CVSS PR:N/UI:N). The vulnerability is exploitable over the network without any special configuration of the target system. Exploitation requires only that the target application is processing C2PA manifest or Content Credentials data sourced from attacker-controlled input - the primary limiting factor is whether the affected SDK or tool is reachable from untrusted network sources. Deployments that process only internally generated or pre-validated content, or those shielded behind authentication walls before reaching the C2PA processing layer, face meaningfully reduced exposure. Impact is strictly limited to availability (A:H); confidentiality and integrity are not affected (C:N/I:N). |
| Impact | The CVSS 7.5 score accurately reflects a medium-high risk for availability: the attack is network-reachable, requires no authentication, no special configuration, and no user interaction, making it straightforward to trigger. However, risk to confidentiality and integrity is zero - this is a pure DoS class vulnerability. No EPSS data was provided in the available intelligence, and the absence of a KEV listing suggests exploitation has not been observed at scale as of this analysis. No public proof-of-concept code has been identified. The practical risk is highest for services that expose C2PA or Content Credentials processing directly to untrusted network input - pipeline servers, API gateways, or media ingestion workflows built on the Rust SDK. Deployments that process only internally sourced or pre-validated media face substantially lower exposure. Overall, this is a real but bounded risk: prioritize patching for internet-facing or high-throughput media processing services while treating internal, access-controlled deployments as lower urgency. |
| Exploit ScenarioDerived | An attacker submits a specially crafted C2PA manifest or Content Credentials payload - possibly a deeply nested, recursive, or artificially inflated structure - to an internet-accessible service running the vulnerable Rust SDK or c2pa_tool. The parser processes the malicious input without enforcing resource bounds, consuming available memory or CPU until the application becomes unresponsive and legitimate requests fail. No public proof-of-concept has been identified, but the straightforward AV:N/AC:L/PR:N profile means exploitation requires only network access and knowledge of the C2PA data format. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Uncontrolled resource consumption in Adobe's Content Credentials ecosystem - specifically the c2pa_tool and Content Credentials Rust SDK - allows unauthenticated remote attackers to exhaust system resources and trigger application denial-of-service with no user interaction required. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms a straightforward network-exploitable path requiring neither authentication nor privilege. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is confined to availability.
RemediationAI
Apply the vendor-supplied patch documented in Adobe Security Bulletin APSB26-110, available at https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html. The exact fixed version is not derivable from the available CPE data (version fields are wildcards) and must be confirmed directly from the advisory before deploying. If immediate patching is not possible, consider restricting the attack surface: limit input to c2pa_tool or the Content Credentials Rust SDK to content sourced from trusted, validated origins rather than arbitrary user-supplied files; impose upstream file-size and request-rate limits at the ingestion layer (e.g., reverse proxy or API gateway) to reduce the resource window available to an attacker. Rate-limiting will reduce DoS severity but not eliminate it, and introduces latency for legitimate high-volume pipelines. Disabling public-facing C2PA processing endpoints entirely is the most effective temporary control where operationally feasible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected components are Adobe's c2pa_tool and content_credentials_rust_sdk, both Rust-based implementations of the Coalition for Content Provenance and Authenticity (C2PA) standard - an open specification for embedding cryptographic provenance metadata into digital media files (images, video, audio, documents). CWE-400 (Uncontrolled Resource Consumption) indicates the SDK or tool fails to impose bounds on resource usage when processing input, likely during parsing of C2PA manifests or content credential payloads. In Rust SDK contexts, this class of flaw often manifests as unbounded allocation triggered by attacker-controlled length fields or recursive structures in malformed manifests, leading to memory exhaustion or CPU saturation before the runtime can recover. CPE strings (cpe:2.3:a:adobe:c2pa_tool:*:*:*:*:*:*:*:* and cpe:2.3:a:adobe:content_credentials_rust_sdk:*:*:*:*:*:*:*:*) indicate all versions in the NVD data are potentially affected, with precise version bounds to be confirmed in APSB26-110.
Know when C2Pa Tool gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable parser, no authentication or interaction required; impact is availability-only with no confidentiality or integrity effect, matching the DoS-only description.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Executive ViewAI
Adobe Content Credentials tools (c2pa_tool and Rust SDK) are vulnerable to unauthenticated denial-of-service attacks through uncontrolled resource consumption, creating service disruption risk for organizations using these components. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable by any network-connected attacker requiring neither authentication nor user interaction. Organizations must immediately assess deployment scope and implement interim protections pending vendor patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) network-level rate limiting and connection throttling to restrict untrusted sources, (2) application-level resource quotas on Content Credentials operations, (3) architectural isolation of affected components to contain blast radius, and (4) monitoring for unusual resource consumption spikes indicative of exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper input validation in Adobe's CAI Content Credentials tooling - spanning both the C2PA Tool and the Content Crede
Integer underflow in Adobe's Content Credentials Rust SDK and C2PA Tool allows unauthenticated remote attackers to crash
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processin
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive
Exploit-DB