PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-100128 Adobe CVE debrief

CVE-2026-100128 is an out-of-bounds write vulnerability in Adobe Bridge that could result in arbitrary code execution. This CVE was published on 2026-10-13T20:41:23.699Z and was last modified on 2026-10-14T10:40:49.815Z. The NVD entry is currently Unclassified. Defenders responsible for systems using Adobe Bridge, particularly those using versions 15.1.8 and earlier or 16.0.7 and earlier, should assess potential exposure and impact. The vulnerability requires user interaction, specifically opening a malicious file, and has a CVSS score of 7.8 with a severity of HIGH.

Vendor
Adobe
Product
Adobe Bridge
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-13
Original CVE updated
2026-10-14
Advisory published
2026-10-13
Advisory updated
2026-10-14

Who should care

Defenders responsible for systems using Adobe Bridge, particularly those using versions 15.1.8 and earlier or 16.0.7 and earlier, should assess potential exposure and impact.

Why it matters

CVE-2026-100128 is an out-of-bounds write vulnerability in Adobe Bridge that could result in arbitrary code execution. Defenders should prioritize verifying exposure and assessing potential impact on systems using affected versions.

  • Verify potential exposure and assess impact on systems using affected Adobe Bridge versions
  • Monitor user interactions with files to detect potential exploitation attempts
  • Prioritize updating Adobe Bridge to versions 15.1.9 or 16.0.8 if necessary

Technical summary

The vulnerability is an out-of-bounds write issue in Adobe Bridge that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The issue affects Adobe Bridge versions 15.1.8 and earlier or 16.0.7 and earlier. Defenders should prioritize verifying exposure and assessing potential impact on systems using affected versions.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact on systems using Adobe Bridge versions 15.1.8 and earlier or 16.0.7 and earlier.

Recommended defensive actions

  • Verify Adobe Bridge version and update to 15.1.9 or 16.0.8 if necessary
  • Assess potential impact on systems using affected versions
  • Monitor for user interactions with malicious files

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and potential impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-100128 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-100128

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-100128 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-100128

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Bridge | Out-of-bounds Write (CWE-787)

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100128.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.adobe.com/trust/security/products/bridge/apsb26-167.html

    Supplemental source - vendor-advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.