Adobe Content Credentials SDK: Uncontrolled resource consumption leads to denial of service
Summary
Adobe Content Credentials SDK, including the Rust SDK (c2pa) and the C2PA Tool (c2patool), contains an uncontrolled resource consumption flaw (CWE-400). An attacker can exhaust system resources and crash the affected application, causing a denial of service. Exploitation requires a victim to visit a maliciously crafted URL or interact with a compromised web page, so exposure depends on whether applications process untrusted content with these tools.
Affected
- Content Credentials Rust SDK (c2pa) c2pa-v0.91.10 and earlier
- C2PA Tool (c2patool) c2patool-v0.28.5 and earlier
- All platforms
Fixed in
- Content Credentials Rust SDK (c2pa) c2pa-v0.91.11
- C2PA Tool (c2patool) c2patool-v0.28.6
Workaround
Unknown. No vendor-documented workaround is available; the vendor fix is the update itself.
Exploitation
- Adobe is not aware of any exploits in the wild.
- No public proof of concept found.
- Not listed as known exploited by the aggregator consulted.
Our recommendation
- Inventory all c2patool binaries and projects or CI/CD images that use the c2pa Rust crate.
- Update to c2pa-v0.91.11 or c2patool-v0.28.6 or later, applying the whole Adobe bulletin APSB26-184.
- Until patched, restrict untrusted files and URLs reaching these tools and run them with resource limits or in an isolated container.
- Prioritise internet-facing media processing services.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-184 www.adobe.com
- CVE Record CVE-2026-122097 www.cve.org
- OffSeq threat radar entry radar.offseq.com
- HKCERT Adobe November 2026 bulletin www.hkcert.org
- CAI SDK documentation opensource.contentauthenticity.org
- c2pa-rs CLI documentation github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:54.
Original description (NVD)
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.