CVE-2026-34678: Adobe C2pa DOS Vulnerability

CVE-2026-34678 Overview

CVE-2026-34678 affects the Adobe Content Authenticity Initiative (CAI) Content Credentials SDK. The flaw is an Uncontrolled Resource Consumption weakness [CWE-400] in c2pa versions 0.78.2, 0.7.0, and earlier, as well as the c2pa-web Node.js binding. An attacker with local access can submit crafted input that exhausts system resources, producing an application denial-of-service condition. Exploitation does not require user interaction or authentication. Adobe published the issue on 2026-05-12 and tracks the fix in advisory APSB26-53.

Critical Impact

Local attackers can crash applications that embed the C2PA SDK by triggering resource exhaustion during content credential processing, disrupting availability of media verification workflows.

Affected Products

• Adobe c2pa (Rust crate) versions 0.78.2, 0.7.0, and earlier
• Adobe c2pa-web (Node.js) versions 0.78.2, 0.7.0, and earlier
• Applications embedding the CAI Content Credentials SDK for media signing or verification

Discovery Timeline

• 2026-05-12 - CVE-2026-34678 published to NVD
• 2026-05-15 - Last updated in NVD database

Technical Details for CVE-2026-34678

Vulnerability Analysis

The Coalition for Content Provenance and Authenticity (C2PA) SDK parses and validates manifests embedded in media assets. The vulnerability stems from missing or insufficient limits on resource consumption during this processing path. When the SDK ingests a crafted asset or manifest, it allocates resources without bounding the work performed against the input. The result is exhaustion of CPU, memory, or another finite resource on the host running the SDK.

The issue applies to both the Rust crate c2pa and the Node.js binding c2pa-web. Any service or desktop application that calls these libraries to verify or generate Content Credentials inherits the exposure. Because the attack vector is local, the attacker must deliver the malicious asset to a processing pipeline that already has access to it, such as a queued upload, a shared workspace, or a developer tool.

Root Cause

The defect is classified under [CWE-400] Uncontrolled Resource Consumption. The SDK does not enforce adequate bounds on the size, depth, or iteration count of structures encountered while parsing C2PA manifests. Maliciously shaped input drives the parser into work that scales beyond available resources.

Attack Vector

An attacker delivers a malformed media file or manifest to an application that calls the C2PA SDK. The processing routine consumes excessive CPU or memory and the host process becomes unresponsive or terminates. No authentication, network access, or user interaction is needed once the input reaches the parser.

No verified proof-of-concept code is available. Refer to the Adobe advisory
for technical details: https://helpx.adobe.com/security/products/content-authenticity-sdk/apsb26-53.html

Detection Methods for CVE-2026-34678

Indicators of Compromise

• Repeated crashes or out-of-memory terminations in services that invoke c2pa or c2pa-web during manifest parsing
• Sustained CPU saturation on processes loading the C2PA SDK while handling a single asset
• Unusually large or deeply nested C2PA manifests submitted to ingestion pipelines

Detection Strategies

• Instrument applications that link the C2PA SDK with per-request CPU and memory ceilings and alert when limits are exceeded
• Log the SHA-256 hash and size of every asset processed by c2pa to correlate crashes with specific inputs
• Track exit codes and signals (SIGKILL, OOM) of worker processes that perform Content Credential verification

Monitoring Recommendations

• Monitor container or service restart counts for workloads embedding the C2PA SDK
• Alert when resident memory of a C2PA worker exceeds an empirical baseline within a short window
• Forward parser error logs from c2pa and c2pa-web to centralized logging for trend analysis

How to Mitigate CVE-2026-34678

Immediate Actions Required

• Inventory all internal services, build pipelines, and Node.js applications that depend on c2pa or c2pa-web
• Upgrade affected dependencies to the fixed versions identified in the Adobe Security Advisory APSB26-53
• Restrict which users or systems can submit media assets to processing pipelines that invoke the C2PA SDK

Patch Information

Adobe addresses CVE-2026-34678 in the Content Authenticity SDK release referenced by APSB26-53. Update the c2pa Rust crate and the c2pa-web Node.js package to the patched versions listed in that advisory and rebuild dependent applications.

Workarounds

• Run C2PA parsing in isolated worker processes with strict CPU time and memory cgroup limits
• Reject media assets exceeding a defined size threshold before they reach the SDK
• Queue Content Credential verification through a rate-limited service to contain resource exhaustion impact

# Example: constrain a C2PA worker with systemd resource limits
[Service]
ExecStart=/usr/local/bin/c2pa-worker
MemoryMax=512M
CPUQuota=50%
TasksMax=64
TimeoutStopSec=30