Is CVE-2026-100895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100895 being exploited in the wild.

How severe is CVE-2026-100895?

Medium severity, with a CVSS score of 5.3, published 28 September 2026.

Which products and versions are affected?

Trusted Domain Project OpenARC up to 1.0.0.Beta1.

Is there a fix for CVE-2026-100895?

A patch was published on 2015-07-02: Version 1.0.0.Beta0 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100895 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100895?

Check whether you run Trusted Domain Project OpenARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100895: Trusted Domain Project OpenARC null pointer dereference in arc_parse_canon_t

CVE-2026-100895 · Severity: medium · CVSS 5.3 · Published 2026-09-28

Trusted Domain Project OpenARC is a library used for DKIM and ARC email authentication. A null pointer dereference vulnerability in the arc_parse_canon_t function allows remote attackers to cause a denial of service by sending specially crafted email messages. An exploit has been made public, increasing the risk of widespread attacks.

Vendors: Trusted Domain Project.

Quick answers

Is CVE-2026-100895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100895 being exploited in the wild.
How severe is CVE-2026-100895?: Medium severity, with a CVSS score of 5.3, published 28 September 2026.
Which products and versions are affected?: Trusted Domain Project OpenARC up to 1.0.0.Beta1.
Is there a fix for CVE-2026-100895?: A patch was published on 2015-07-02: Version 1.0.0.Beta0 released with fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100895 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100895?: Check whether you run Trusted Domain Project OpenARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a null pointer dereference in the arc_parse_canon_t function within libopenarc/arc-canon.c, triggered through remote manipulation of input data. The attack requires no authentication or user interaction and can be exploited over the network. A successful exploit crashes the application, resulting in denial of service.

Affected products

Trusted Domain Project OpenARC up to 1.0.0.Beta1

Timeline

2026-09-28: disclosed
2015-07-02: patched: Version 1.0.0.Beta0 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.