CVE-2026-106627: 
NixOS Analisi e mitigazione delle vulnerabilità

CVE-2026-106627 is an Uncontrolled Resource Consumption (CWE-400) vulnerability affecting Adobe's CAI Content Credentials suite, which could lead to application denial-of-service. An unauthenticated remote attacker can exploit this vulnerability to exhaust system resources without requiring user interaction. Affected products include the Content Credentials Rust SDK (c2pa) up to and including v0.90.15, C2PA Tool (c2patool) up to and including v0.27.15, and the Content Credentials JS SDK (c2pa-web) up to and including v0.13.4. The vulnerability was published on October 13, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), meaning the affected software fails to properly control the allocation and maintenance of limited system resources when processing certain inputs. The attack vector is network-based, requires no privileges, and no user interaction, making it fully automatable (confirmed by NVD SSVC assessment). Related attack patterns include CAPEC-147 (XML Ping of the Death) and CAPEC-492 (Regular Expression Exponential Blowup), suggesting the root cause may involve unbounded processing of specially crafted input data — such as malformed C2PA manifests or media files — that triggers excessive resource consumption in the SDK's parsing or validation logic (GitHub Advisory, Adobe Advisory).

Successful exploitation results in an application denial-of-service condition by exhausting system resources (CPU, memory, or both) on the host running the affected CAI Content Credentials components. The impact is limited to availability — there is no confidentiality or integrity impact. Applications or services that rely on the Content Credentials Rust SDK, JS SDK, or C2PA Tool for processing or validating C2PA-signed media content would become unresponsive or crash, potentially disrupting content authenticity verification workflows (GitHub Advisory, Adobe Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation at this time (GitHub Advisory). The NVD SSVC assessment confirms no known exploitation and classifies the vulnerability as automatable with partial technical impact. The EPSS score is approximately 0.636% (49th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Adobe has released patched versions for all affected components. Users should upgrade to the following fixed versions: Content Credentials Rust SDK (c2pa) to v0.91.1 or later, C2PA Tool (c2patool) to v0.28.1 or later, and Content Credentials JS SDK (@contentauth/c2pa-web) to v0.15.3 or later. No configuration-based workarounds have been published; upgrading to the patched versions is the recommended remediation. Additionally, monitoring system resource usage for anomalous spikes may help detect exploitation attempts (Adobe Advisory, GitHub Advisory).

The vulnerability received brief coverage on Mastodon via TheHackerWire shortly after disclosure, and was picked up by automated vulnerability tracking services including AusCERT and cve.report. No significant researcher commentary or broader media coverage has been identified beyond standard advisory republication (GitHub Advisory).