CVE-2026-100138(adobe / c2pa)

LOWCVSS 7.5 · HIGH

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.

0.0/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • c2pa
  • c2pa-web
  • c2patool

Affected systems

Vendors
Products
c2pac2pa-webc2patool

Deep dive

Full discourse1 post
  • DFIR Lab@DFIR_Lab

    🚨 HIGH SEVERITY: CVE-2026-100138 CAI Content Credentials vulnerable to resource exhaustion DoS (CVSS 7.5). Remote exploitation requires no user interaction. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity https://t.co/5lGFRFXQBE

    0000023
    150 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appadobec2pa-rust-
Appadobec2pa-web-node.js-
Appadobec2patool---

Explore more