An uncontrolled resource consumption flaw in Adobe's Content Credentials components could allow an attacker to exhaust system resources, resulting in a denial of service without requiring any user interaction. The vulnerability is identified as CWE-400 and could cause applications using the affected SDKs or tools to become unresponsive or crash when the resource limits are exceeded.

Adobe products affected by this issue include the C2PA Tool, the Content Credentials JavaScript SDK, and the Content Credentials Rust SDK. No specific version information is provided in the advisory, so all releases of these products should be considered potentially vulnerable until an official patch is released.

The CVSS score of 7.5 indicates a moderate to high severity. The EPSS score is below 1 %, suggesting that it is currently considered a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack likely occurs via remote or local input that triggers excessive resource usage, though the precise vector is not detailed. Given the impact and the existing risk indicators, organizations should treat this as a significant risk even if exploitation is unlikely at present.