CAI Content Credentials has an uncontrolled resource consumption flaw (CWE-400) that can cause applications to become unavailable by exhausting CPU, memory or other critical resources. Exploitation does not depend on user interaction, allowing an attacker to trigger the condition by supplying specific input to the targeted service.

Adobe’s C2PA Tool, Content Credentials JavaScript SDK, and Content Credentials Rust SDK are affected. No explicit version information is listed, implying that all current releases may be vulnerable until a patch is applied.

The CVSS score of 7.5 classifies this as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. It is not listed in CISA’s KEV catalog. The likely attack vector is through crafted requests or inputs sent over the network from a remote source that trigger excessive resource usage; this inference is based on the description that the flaw can be exploited without user interaction.