CVE-2026-113574

MediumCVSS 4.0/10Last modified Nov 12, 2026

Description

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Adobe	Content Credentials Rust SDK	<= c2pa-v0.91.10
Adobe	C2PA Tool	<= c2patool-v0.28.5

References

https://www.adobe.com/trust/security/products/content-credentials-sdk/apsb26-184.html

Timeline

Published: Nov 10, 2026
Last modified: Nov 12, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1135757.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-1135766.3Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that c CVE-2026-1135775.5Premiere Pro is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker coul CVE-2026-1135785.5Photoshop Desktop is affected by an Uncontrolled Recursion vulnerability that could result in an application denial-of-service. An attacker CVE-2026-1135799.9Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbi CVE-2026-113584.4The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cros CVE-2026-1135809.9Adobe Experience Manager is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbi CVE-2026-1135827.5UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive dat CVE-2026-1135836.1Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary CVE-2026-1135849.8The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates accoun CVE-2026-113594.3The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized p CVE-2026-1135933.1An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddle