CVE-2026-71360

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published Aug 25, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

Analysis

Technical impact

The vulnerability allows an attacker to trigger uncontrolled resource consumption, causing the application to exhaust CPU, memory or other system resources. This results in a denial‑of‑service condition in which the affected program becomes unavailable or unusable. The flaw is identified as a CWE‑400 resource exhaustion weakness and can be triggered without any user interaction.

Affected Systems

Adobe’s C2PA Tool and Adobe Content Credentials Rust SDK are impacted. No specific version information is supplied, so all releases of these products are susceptible until a patch is applied.

Risk and Exploitability

With a CVSS score of 7.5 the risk is considered high; the EPSS score is not provided and the issue is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, likely through crafted content or requests sent to the tool, since user interaction is not required. If exploited, the application will become unresponsive, potentially affecting services that depend on it.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

C2PA Tool

unaffected

Version	Status	Constraints
`0`	affected	≤ c2patool-v0.26.70
`c2patool-v0.27.11`	unaffected	—

Adobe

Content Credentials Rust SDK

unaffected

Version	Status	Constraints
`0`	affected	≤ c2pa-v0.89.0
`c2pa-v0.90.11`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:adobe:c2pa::::::rust::*
	cpe:2.3:a:adobe:c2patool::::::::

No data.

Vendor Product Versions

Adobe

C2pa

Version	Status	Scheme	Platform
`[0,c2pa-v0.89.0]`	affected	generic	—
`c2pa-v0.90.11`	unaffected	generic	—

Adobe

C2patool

Version	Status	Scheme	Platform
`[0,c2patool-v0.26.70]`	affected	generic	—
`c2patool-v0.27.11`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Adobe update for the C2PA Tool and Content Credentials Rust SDK as soon as it becomes available.
Implement request throttling or rate limiting on input processing paths to constrain the rate at which resource‑intensive operations can be invoked.
Configure monitoring and alerting to detect abnormal spikes in CPU or memory usage, and enforce automatic restart or shutdown policies for the service when thresholds are exceeded.

Generated by OpenCVE AI on August 25, 2026 at 20:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.902% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html

History

Sep 9, 2026 2:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe c2pa Adobe c2patool
CPEs		cpe:2.3:a:adobe:c2pa::::::rust::* cpe:2.3:a:adobe:c2patool::::::::
Vendors & Products		Adobe Adobe c2pa Adobe c2patool

Aug 26, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 25, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
Title		CAI Content Credentials \| Uncontrolled Resource Consumption (CWE-400)
Weaknesses		CWE-400
References		https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-110.html
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`