Executive brief
Adobe Content Credentials (C2PA) libraries are used to verify the authenticity and origin of digital media. A security flaw in these libraries allows an attacker to trigger excessive resource consumption, which can crash the application or make it unresponsive. This could disrupt services that rely on verifying image or video credentials, though it does not directly expose private user data.
Technical details
The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) within the Adobe Content Authenticity Initiative (CAI) SDK. It affects both the Node.js (c2pa-web) and Rust (c2pa-v) implementations. An attacker can exploit this flaw to exhaust system resources such as CPU or memory, resulting in an application-level denial-of-service (DoS). The attack vector is local and does not require user interaction or specific privileges. Patches have been released in c2pa-web version 0.7.1 and c2pa-rust version 0.80.1.
Affected products
- Adobe c2pa-web <= 0.7.0
- Adobe c2pa-rust (c2pa-v) <= 0.78.2
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory