CAI Content Credentials, including the C2PA Tool, JavaScript SDK, and Rust SDK, contains an uncontrolled resource consumption flaw that can lead to application denial‑of‑service by exhausting system resources. An attacker can trigger this condition without any user interaction, causing the impacted application or service to become unresponsive.

Adobe Content Credentials C2PA Tool, Adobe Content Credentials JavaScript SDK, and Adobe Content Credentials Rust SDK are affected. The list of affected versions is not specified in the advisory, so any deployment of these components should be reviewed for updates or vulnerability assessments.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of less than 1% shows a very low likelihood of exploitation at the moment. The vulnerability is not listed in CISA’s KEV catalog. Given that no user interaction is required, the attack vector is likely remote application‑level, allowing an adversary to trigger excessive resource use from outside the targeted system.