The CAI Content Credentials product contains a resource exhaustion vulnerability that can cause the application to consume excessive CPU or memory, ultimately denying service to legitimate users. This flaw is identified as CWE-400, an uncontrolled resource consumption weakness. Exploitation does not require user interaction, allowing an attacker to trigger the condition remotely or locally, depending on the attacker’s ability to send specially crafted requests to the component.

Adobe CAI Content Credentials versions 0.78.2, 0.7.0, and all earlier releases are impacted. These versions are part of Adobe’s Content Authenticity SDK used for content verification and authentication within applications that rely on this library.

The CVSS score of 7.5 indicates a high severity impact, and because the EPSS score is not available, the precise likelihood of exploitation is unknown. The vulnerability is not listed in CISA’s KEV catalog, suggesting that widely known, active exploitation has not been documented. Attackers could trigger the issue without interacting with the system’s UI, indicating that remote exploitation is likely feasible if network access to the vulnerable component exists.