An uncontrolled consumption of system resources can be forced by an attacker, potentially exhausting memory, CPU, or I/O capacity and causing the affected application to become unresponsive. The issue is classified as CWE-400 and does not require any user interaction, meaning it can be leveraged remotely to disrupt service availability.

Adobe’s C2PA Tool and the Content Credentials JS and Rust SDKs are vulnerable, but specific affected versions are not listed in the advisory. Any deployment of these products may be impacted.

The CVSS score of 7.5 indicates a medium‑to‑high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Likely exploitation would involve an attacker sending crafted requests to a running instance of the SDK or Tool, exhausting resources without user action.