CVE-2026-75632: CAI Content Credentials DOS Vulnerability

CVE-2026-75632 Overview

CVE-2026-75632 is an uncontrolled resource consumption vulnerability [CWE-400] in Adobe's Content Authenticity Initiative (CAI) Content Credentials. An unauthenticated remote attacker can exhaust system resources and trigger an application denial-of-service condition. Exploitation requires no user interaction and no privileges. Adobe published guidance for this issue in security bulletin APSB26-147.

The vulnerability affects the availability of the Content Credentials service without impacting confidentiality or integrity. The network-based attack vector and low attack complexity make it accessible to remote attackers. Organizations processing content authenticity metadata should treat this issue as a priority for patching.

Critical Impact
Remote, unauthenticated attackers can crash or hang the CAI Content Credentials application, disrupting content provenance verification workflows.

Affected Products

Adobe CAI Content Credentials (see Adobe security bulletin APSB26-147 for affected versions)
Applications and services embedding the Content Authenticity SDK
Downstream pipelines that rely on Content Credentials for provenance verification

Discovery Timeline

2026-09-22 - CVE-2026-75632 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-75632

Vulnerability Analysis

The vulnerability is classified as Uncontrolled Resource Consumption [CWE-400]. Content Credentials processes untrusted input without applying sufficient bounds on the resources consumed during parsing or validation. An attacker submits crafted input that causes the application to allocate excessive memory, consume CPU cycles, or hold other finite resources.

Because exploitation targets availability only, the outcome is denial of service rather than data disclosure or code execution. The service becomes unresponsive or terminates, disrupting any pipeline that depends on Content Credentials to verify media provenance. Recovery typically requires restarting the affected component.

Adobe documents the fix in bulletin APSB26-147. Refer to the Adobe Security Update APSB26-147 for affected versions and patched builds.

Root Cause

The root cause is missing or insufficient resource limits when handling attacker-controlled content. Common patterns behind [CWE-400] issues include unbounded loops, recursive parsing without depth limits, decompression without size caps, and allocation of buffers sized directly from untrusted length fields. Adobe has not publicly detailed which pattern applies here.

Attack Vector

The attack is remote and network accessible. An attacker submits a crafted request or a malicious asset containing Content Credentials metadata to a service that processes it. No authentication, privileges, or user interaction are required. Repeated submissions can amplify resource pressure and accelerate service failure.

No verified public proof-of-concept code is available. See the Adobe Security Update APSB26-147 for vendor-supplied technical details.

Detection Methods for CVE-2026-75632

Indicators of Compromise

Sudden and sustained spikes in CPU, memory, or file handle usage by processes hosting the Content Authenticity SDK
Repeated crashes, restarts, or out-of-memory events in Content Credentials service logs
Elevated request rates from single sources targeting Content Credentials endpoints, followed by service unavailability
Timeouts and 5xx responses returned by services that verify or generate Content Credentials

Detection Strategies

Instrument the Content Credentials service with resource metrics and alert on threshold breaches for CPU, resident memory, and open descriptors
Correlate application crash events with inbound request patterns to identify malicious traffic bursts
Deploy request-size and content-length inspection at the reverse proxy or web application firewall in front of the service
Baseline normal Content Credentials processing latency and alert on sustained deviation

Monitoring Recommendations

Forward application, container, and host telemetry to a centralized analytics pipeline for correlation across the request path
Track error rate, latency, and saturation as service-level indicators for the Content Credentials component
Retain network flow records for the affected endpoints to support post-incident analysis
Alert on process termination and automatic restarts of the Content Credentials service

How to Mitigate CVE-2026-75632

Immediate Actions Required

Apply the patched Content Authenticity SDK release referenced in Adobe bulletin APSB26-147
Inventory all applications and pipelines that embed the SDK and confirm each is upgraded
Restrict network exposure of Content Credentials endpoints to trusted networks where operationally feasible
Enable rate limiting and request-size limits at any ingress fronting the service

Patch Information

Adobe has published fixed versions in security bulletin Adobe Security Update APSB26-147. Consult the bulletin for the specific affected versions, patched builds, and download locations. Upgrade all instances of the Content Authenticity SDK to the patched release.

Workarounds

Place the Content Credentials service behind a reverse proxy that enforces per-source rate limits and maximum request sizes
Configure operating-system or container resource controls, such as cgroups, to cap CPU and memory per process
Deploy service watchdogs that restart the Content Credentials process on resource saturation to preserve availability
Temporarily disable public exposure of Content Credentials endpoints until patching is complete

bash

# Example: cap CPU and memory for a Content Credentials service container
docker run \
  --name content-credentials \
  --cpus="2.0" \
  --memory="2g" \
  --memory-swap="2g" \
  --pids-limit=512 \
  --restart=on-failure:5 \
  your-registry/content-credentials:patched