Is CVE-2026-100128 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100128 being exploited in the wild.

How severe is CVE-2026-100128?

High severity, with a CVSS score of 7.8, published 13 October 2026.

Which products and versions are affected?

Adobe Bridge 16.0.7 and earlier; Adobe Bridge (LTS) 15.1.8 and earlier.

Is there a fix for CVE-2026-100128?

Yes: fixed in Adobe Bridge 16.0.8, Adobe Bridge (LTS) 15.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100128 attacked?

It is attacked with local access.

Am I affected by CVE-2026-100128?

Check whether you run Adobe Bridge or Adobe Bridge (LTS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100128: Adobe Bridge out-of-bounds write arbitrary code execution

CVE-2026-100128 · Severity: high · CVSS 7.8 · Published 2026-10-13

Adobe Bridge is a digital asset management application used by creative professionals to organize and preview media files. Multiple out-of-bounds write vulnerabilities in Bridge could allow an attacker to execute arbitrary code on a user's system if they open a malicious file. This could result in complete system compromise, including data theft, installation of malware, or unauthorized access to sensitive creative assets and documents.

Technologies: Adobe Bridge, Adobe Bridge (LTS). Vendors: Adobe.

Quick answers

Is CVE-2026-100128 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100128 being exploited in the wild.
How severe is CVE-2026-100128?: High severity, with a CVSS score of 7.8, published 13 October 2026.
Which products and versions are affected?: Adobe Bridge 16.0.7 and earlier; Adobe Bridge (LTS) 15.1.8 and earlier.
Is there a fix for CVE-2026-100128?: Yes: fixed in Adobe Bridge 16.0.8, Adobe Bridge (LTS) 15.1.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100128 attacked?: It is attacked with local access.
Am I affected by CVE-2026-100128?: Check whether you run Adobe Bridge or Adobe Bridge (LTS) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Adobe Bridge 16.0.8, Adobe Bridge (LTS) 15.1.9

Technical details

Three out-of-bounds write vulnerabilities (CVE-2026-100129, CVE-2026-100128, CVE-2026-100127) in Adobe Bridge allow arbitrary code execution via a crafted input file processed by the application. Attack requires local access and user interaction (opening a malicious file), with no privilege escalation needed. An additional out-of-bounds read vulnerability (CVE-2026-100126) leads to memory exposure. All are rated high/medium severity with CVSS scores of 7.8 and 5.5 respectively.

Affected products

Adobe Bridge 16.0.7 and earlier
Adobe Bridge (LTS) 15.1.8 and earlier

Timeline

2026-10-13: disclosed

References

https://www.adobe.com/trust/security/products/bridge/apsb26-167.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.