Is CVE-2026-100902 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100902 being exploited in the wild.

How severe is CVE-2026-100902?

Medium severity, with a CVSS score of 6.5, published 28 September 2026.

Which products and versions are affected?

Barco ClickShare CX-20 Gen2 up to 02.26.00.0007.

Is there a fix for CVE-2026-100902?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-100902 attacked?

It is attacked over the network.

Am I affected by CVE-2026-100902?

Check whether you run Barco ClickShare CX-20 Gen2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100902: Barco ClickShare CX-20 Gen2 denial of service in wallpaper upload

CVE-2026-100902 · Severity: medium · CVSS 6.5 · Published 2026-09-28

Barco ClickShare CX-20 Gen2 is a wireless presentation device used in conference rooms and corporate environments. An authenticated attacker can upload a malformed image file to permanently disable the device's wallpaper functionality or entire web service, rendering it unusable until a factory reset is performed. The device fails to properly validate uploaded files, allowing crafted files to cause a crash that persists even after reboot.

Vendors: Barco.

Quick answers

Is CVE-2026-100902 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100902 being exploited in the wild.
How severe is CVE-2026-100902?: Medium severity, with a CVSS score of 6.5, published 28 September 2026.
Which products and versions are affected?: Barco ClickShare CX-20 Gen2 up to 02.26.00.0007.
Is there a fix for CVE-2026-100902?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-100902 attacked?: It is attacked over the network.
Am I affected by CVE-2026-100902?: Check whether you run Barco ClickShare CX-20 Gen2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /wallpaper endpoint in Barco ClickShare CX-20 Gen2 firmware 02.26.00.0007 and earlier improperly validates file content, checking only magic bytes (FFD8FFE0) without validating the complete file structure. An authenticated attacker can upload a polyglot JPEG file with trailing data after the EOI marker (FFD9), causing an unhandled exception that triggers HTTP 500 and corrupts persistent storage. The broken state survives reboots and in some cases disables the entire HTTPS service, requiring factory reset to restore.

Affected products

Barco ClickShare CX-20 Gen2 up to 02.26.00.0007

Timeline

2026-09-28: disclosed: Vulnerability publicly disclosed via GitHub
2026-08: other: Vulnerability discovered and vendor notified

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.