An attacker can trigger excessive use of system resources in Adobe CAI Content Credentials without requiring user interaction, leading to an application denial‑of‑service. The vulnerability carries a CVSS score of 7.5, indicating a moderate‑to‑high impact. It originates from a failure to protect against unchecked resource usage, classified as CWE‑400. The effect is a loss of availability for users of the affected service.

Adobe CAI Content Credentials, specifically the c2pa-web@0.7.1, c2pa-v0.80.1 and all earlier releases.

The CVSS score reflects a significant risk, and the absence of a KEV listing or an EPSS value means the exploitation likelihood is unknown but could be high given the lack of user interaction. Likely, an attacker can exploit the vulnerability remotely through the service interface, sending crafted requests that exhaust CPU, memory, or other resources. Once resources are depleted, legitimate requests cannot be processed, resulting in a denial‑of‑service for legitimate users.