CVE-2026-100139
7.5HighPublished 13 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote, unauthenticated attackers can cause a denial of service by exhausting application resources. Exploitation requires network access to the target application processing Content Credentials without any user interaction.
Root cause
The application fails to control or limit resource consumption during processing, leading to resource exhaustion.
Affected systems
CAI Content Credentials; specific versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade to the patched version referenced in Adobe advisory APSB26-163; if patching must wait, restrict network access to endpoints parsing untrusted Content Credentials.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.