CVE-2026-71360

VENDOR_NAME: Adobe AFFECTED_VERSION: Unspecified MITRE_TACTIC: T1499 — Endpoint Denial of Service CWE_ID: CWE-400 CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H POC_STATUS: Public PATCH_DETAILS: Unconfirmed patch reference in NVD (Patch Confidence: 2/4)

Executive Summary

CVE-2026-71360 is a network-reachable Uncontrolled Resource Consumption vulnerability (CWE-400) impacting Adobe Content Authenticity Initiative (CAI) Content Credentials (C2PA technology stack). The vulnerability allows a remote, unauthenticated attacker to trigger an application denial-of-service (DoS) condition by exhausting host system resources. Because exploitation requires zero user interaction and carries a CVSS v3.1 base score of 7.5, enterprise media processing pipelines, web platforms, and digital asset management (DAM) solutions integrating CAI metadata parsers face immediate risk of operational disruption.

Technical Analysis

The vulnerability lies within the processing engine of CAI Content Credentials, an open technical standard designed to provide cryptographic provenance and attribution metadata for digital media (such as JPEGs, PNGs, AVIFs, MP4s, and PDFs). C2PA manifests contain nested metadata structures, cryptographic signatures, assertions, and lineage trees embedded directly within media file headers or sidecar files.

Under CWE-400 (Uncontrolled Resource Consumption), the software fails to impose adequate upper bounds on allocation requests, recursion depth, memory buffers, or processing loops when parsing incoming Content Credentials structure payloads. When a media file containing a specifically structured or deeply nested C2PA manifest is submitted to an application relying on vulnerable CAI libraries, the parser enters an unbounded processing state or allocates excessive heap memory and CPU cycles.

Because the vulnerability mechanism operates at the network attack vector (AV:N) without requiring privilege (PR:N) or user interaction (UI:N), any automated system that parses media files upon upload or ingestion is exposed. Attackers do not need to execute arbitrary code to achieve their objective; rather, they exploit the deterministic resource consumption behavior of the parser to stall threads, trigger Out-Of-Memory (OOM) killer terminations, or hang application worker pools, resulting in complete denial of service for the target service component.

Exploitation Scenarios

No specific function names, code paths, or private API parameters have been disclosed in the advisory data. The following attack chain describes the standard operational sequence for this vulnerability class:

1. Reconnaissance & Target Identification: The attacker identifies target web applications, enterprise Content Management Systems (CMS), digital asset management suites, or public media submission portals that parse CAI Content Credentials / C2PA provenance manifests upon file upload or stream processing.
2. Flaw Triggering Payload Generation: The attacker crafts a custom media file (e.g., JPEG, PNG, or MP4) containing a specially constructed C2PA manifest structure. The manifest contains data patterns engineered to trigger high-complexity decoding, such as deeply nested assertions, circular metadata structures, or extreme allocation lengths that violate standard operational assumptions.
3. Payload Delivery: The attacker transmits the payload to the application over standard network protocols (such as an HTTP POST request to a file upload or media validation endpoint). No credentials, session tokens, or user interactions are required to initiate parsing.
4. Post-Exploitation Impact: Upon receiving the file, the server's CAI parsing library attempts to process the C2PA manifest. The server experiences immediate CPU spike (100% utilization across available worker cores) or rapid RAM exhaustion, causing application worker processes to crash or freeze. Subsequent legitimate request processing fails, achieving targeted or service-wide application denial-of-service.

Impact Assessment

The business and technical impact of CVE-2026-71360 is concentrated on system availability:

• Availability Impact (High): Exhaustion of CPU, RAM, or worker thread pools can crash ingestion microservices, leading to service disruption, degraded user experience, and potential collateral failure of adjacent microservices sharing physical or containerized resources.
• Integrity & Confidentiality Impact (None): The vulnerability does not grant unauthorized access to confidential system memory, nor does it allow modifications to data, unauthorized file writes, or arbitrary code execution (C:N/I:N).
• Blast Radius: High for systems performing automated background indexing, media processing, or validation of user-submitted media files. Multi-tenant processing architectures without container-level resource limits (cgroups/namespaces) risk cross-tenant performance degradation.

CVSS Metrics Breakdown

• Base Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Exploitability Subscore: 3.9 (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None)
• Impact Subscore: 3.6 (Availability: High, Integrity: None, Confidentiality: None)

Detection Guidance

Sigma Rule

title: CAI Content Credentials Resource Exhaustion DoS Attempt
id: a7f89c12-3b4e-4f10-9123-890abcde2026
status: experimental
description: Detects process failures, unusual memory spikes, or crashes in application workers parsing C2PA / CAI media files.
author: ValtersIT Threat Intelligence
date: 2026-03-30
tags:
    - attack.denial_of_service
    - attack.t1499
    - cve.2026.71360
logsource:
    category: process_defunct
    product: linux
detection:
    selection_crash:
        EventID: 1  # Standard process crash/termination event
        Keywords:
            - 'out of memory'
            - 'OOM-killer'
            - 'SIGSEGV'
            - 'SIGABRT'
    selection_process:
        Image|contains:
            - 'c2pa'
            - 'cai'
            - 'media-processor'
            - 'imagemagick'
            - 'ffmpeg'
    condition: selection_crash and selection_process
falsepositives:
    - High-volume legitimate media conversion tasks handling unusually large standard files.
level: high

YARA Rule

rule CVE_2026_71360_C2PA_Resource_Exhaustion_Payload {
    meta:
        description = "Detects anomalous or deeply nested C2PA manifest signatures designed to cause resource consumption DoS"
        author = "ValtersIT Threat Intelligence"
        date = "2026-03-30"
        cve = "CVE-2026-71360"
        score = 75
    strings:
        // C2PA standard box header in ISO BMFF / JPEG headers
        $c2pa_box = "c2pa" ascii
        $c2pa_manifest = "http://c2pa.org/declarations/" ascii
        
        // Pattern indicating potential assertion/manifest duplication abuse
        $nest_pattern = "stVer" ascii wide
        $assertion_header = "c2pa.assertions" ascii wide
    condition:
        uint32(0) == 0x20707466 or  // ftyp box
        uint16(0) == 0xD8FF or      // JPEG SOI
        uint32(0) == 0x474E5089     // PNG header
        and $c2pa_box
        and $c2pa_manifest
        and (#nest_pattern > 50 or #assertion_header > 30)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"EXPLOIT Adobe CAI C2PA Content Credentials Resource Consumption Attempt (CVE-2026-71360)"; flow:to_server,established; http.content_type; content:"multipart/form-data"; http.request_body; content:"c2pa"; nocase; content:"http://c2pa.org/declarations/"; distance:0; pcre:"/(c2pa\.assertions.*){20,}/s"; reference:cve,2026-71360; classtype:denial-of-service; sid:10002026; rev:1;)

Elastic Detection

language="eql"
process where event.type == "start" and
  process.name : ("*c2pa*", "*cai*", "*media*parser*", "*image*process*") and
  (
    process.args : ("*--manifest*", "*--c2pa*", "*--validate*") or
    process.parent.name : ("nginx", "httpd", "node", "python", "java")
  ) and
  event.outcome == "failure"

Splunk SPL Query

index=application_logs OR index=web_logs (c2pa OR "content credentials" OR "CAI") 
| eval is_error=if(status>=500 OR log_level=="ERROR" OR log_level=="FATAL", 1, 0)
| stats count sum(is_error) as error_count avg(response_time) as avg_latency by client_ip, uri_path
| where error_count > 10 OR avg_latency > 5000
| sort - error_count

Wazuh OSSEC Rule

<group name="syslog,c2pa,denial_of_service,">
  <rule id="100880" level="10">
    <if_sid>1002</if_sid>
    <match regex="true">c2pa|ContentCredentials|CAI_Parser</match>
    <description>CAI Content Credentials parsing component generated error or forced process termination.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="100881" level="12">
    <if_matched_sid>100880</if_matched_sid>
    <match regex="true">Out of memory|Killed process|SIGABRT|resource exhaustion</match>
    <description>Possible CVE-2026-71360 exploitation attempt causing resource exhaustion DoS.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Analysis

Patch Confidence: 2/4 (CLAIMED) The patch status is based on initial NVD references. Organizations must verify patch releases directly within their software supply chains and CAI/C2PA dependencies before marking remediated status as complete.

1. Immediate Workarounds & Mitigations

• Request Timeout Limits: Enforce strict request processing timeouts (e.g., maximum 2–3 seconds) on web application firewalls (WAF), reverse proxies, and backend microservices handling media parsing.
• Payload Size & Structure Boundaries: Limit max media upload size and restrict header parsing depths prior to sending execution tasks to C2PA parser engines.
• Process Isolation & Sandboxing: Execute CAI parsing components inside containerized environments (e.g., Docker, LXC) or isolated worker threads bound by OS-level resource controls (cgroups memory and CPU quotas).
• Asynchronous Offloading: Process C2PA metadata validation asynchronously using non-blocking background queue workers rather than synchronously within main HTTP request-response threads.

2. Patch & Upgrade Steps

• Monitor the official Adobe Security Bulletins and the upstream C2PA SDK repositories for official releases addressing CVE-2026-71360.
• Recompile or update downstream applications referencing affected C2PA / Content Credentials libraries once confirmed patches are released by the vendor.
• Validate the applied fix in a sandbox environment by running load tests with complex C2PA manifest structures to confirm CPU/memory boundaries are enforced.

3. Long-Term Hardening

• Integrate static application security testing (SAST) and dynamic fuzzing focused on media metadata decoders into continuous integration (CI/CD) pipelines.
• Ensure all third-party open-source media parsers are tracked in an updated Software Bill of Materials (SBOM).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71360
2. C2PA Technical Specifications: https://c2pa.org/specifications/
3. Adobe Content Authenticity Initiative (CAI): https://contentauthenticity.org/
4. CWE-400: Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html