The CAI Content Credentials product, versions c2pa-web@0.7.0, c2pa-v0.78.2, and earlier releases, contains an uncontrolled resource consumption vulnerability that can lead to application denial‑of‑service by exhausting system CPU or memory. An attacker could exploit this flaw without user interaction to trigger excessive resource usage, resulting in a denial‑of‑service condition. This issue is identified as CWE‑400. The lack of required user interaction permits remote or local trigger depending on the ability to send specially crafted requests to the component.

Adobe CAI Content Credentials versions 0.78.2, 0.7.0, and all earlier releases are impacted. These versions are part of Adobe’s Content Authenticity SDK used for content verification and authentication within applications that rely on this library.

The CVSS score of 7.5 indicates a high severity impact, and the EPSS score of 0.00017 (approximately 0.017%) indicates a very low probability that this flaw will be exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, suggesting that widely known, active exploitation has not been documented. Attackers could trigger the issue without interacting with the system’s UI, indicating that remote exploitation is likely feasible if network access to the vulnerable component exists.