Adobe Security Bulletin

Last updated on Oct 13, 2026

Security update available for Adobe Content Credentials SDK | APSB26-163

Bulletin ID

Date published

Priority

APSB26-163

October 13, 2026

style

grid width 12

Summary

Adobe has released a priority 3 security update for Adobe Content Credentials SDK. This update addresses vulnerabilities rated high and medium that could result in security feature bypass, application denial-of-service, and arbitrary file system write.

Adobe is not aware of any exploits in the wild for any of the issues addressed in this update.

Affected Versions

Product

Version

Platform

Content Credentials Rust SDK

c2pa-v0.90.15 and earlier

All

C2PA Tool

c2patool-v0.27.15 and earlier

All

Content Credentials JS SDK

@contentauth/c2pa-web@0.13.4 and earlier

All

style

grid width 12

Solution

Adobe categorizes this update with the following priority rating and recommends users update their installation to the newest version:

Product

Updated version

Platform

Priority rating

Installation instructions

Content Credentials Rust SDK

c2pa-v0.91.1

All

Release Notes

C2PA Tool

c2patool-v0.28.1

All

Release Notes

Content Credentials JS SDK

@contentauth/c2pa-web@0.15.3

All

Release Notes

style

grid width 12

Vulnerability Details

CVE-2026-95634

Vulnerability category: Server-Side Request Forgery (SSRF) (CWE-918)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-100124

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-100123

Vulnerability category: Improper Certificate Validation (CWE-295)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-104345

CVE-2026-100122

CVE-2026-100121

CVE-2026-100120

CVE-2026-100119

CVE-2026-100118

CVE-2026-100117

CVE-2026-100115

Vulnerability category: Improper Access Control (CWE-284)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-100114

CVE-2026-100139

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-100138

CVE-2026-100137

CVE-2026-106627

CVE-2026-95632

Vulnerability category: Improper Verification of Cryptographic Signature (CWE-347)
Vulnerability impact: Security feature bypass
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-100113

CVE-2026-100136

Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Application denial-of-service
Severity: High
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-100135

CVE-2026-103296

Vulnerability category: Improper Verification of Cryptographic Signature (CWE-347)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-105902

Vulnerability category: Uncontrolled Resource Consumption (CWE-400)
Vulnerability impact: Application denial-of-service
Severity: Medium
CVSS base score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2026-100125

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-100116

Vulnerability category: Improper Certificate Validation (CWE-295)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 5.9
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2026-103294

CVE-2026-103820

Vulnerability category: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Vulnerability impact: Arbitrary file system write
Severity: Medium
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVE-2026-102502

Vulnerability category: Improper Verification of Cryptographic Signature (CWE-347)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2026-102501

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Security feature bypass
Severity: Medium
CVSS base score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2026-48377

CVE-2026-48378

Acknowledgments

Adobe would like to thank the following researchers for reporting the relevant issues and for working with Adobe to help protect our customers:

0x0.eth (0x0doteth) — CVE-2026-95634, CVE-2026-100115
Adrian Siefer (adrianblackforest) — CVE-2026-100124, CVE-2026-100123, CVE-2026-100122, CVE-2026-100121, CVE-2026-100119, CVE-2026-100118, CVE-2026-100117, CVE-2026-100139, CVE-2026-100138, CVE-2026-100135, CVE-2026-103297, CVE-2026-100116, CVE-2026-103294, CVE-2026-103296, CVE-2026-102502, CVE-2026-102501, CVE-2026-48378, CVE-2026-48377
Geo-VIE (gvfx) — CVE-2026-100120, CVE-2026-100114, CVE-2026-100125, CVE-2026-105902
bau1u — CVE-2026-100137, CVE-2026-100136, CVE-2026-106627
abfe (abfe) — CVE-2026-95632
Nix (nixxiess) — CVE-2026-100113
wayne g (waynezinn) — CVE-2026-95633, CVE-2026-103820
olumzi (olumzi) — CVE-2026-104345

NOTE: Adobe maintains a public bug bounty program through Intigriti. If you’re an external security researcher interested in identifying and responsibly reporting potential security vulnerabilities to Adobe, please visit the Adobe Bug Bounty Program for more information.

For more information, visit Adobe Security Bulletin and Advisories or email PSIRT@adobe.com.

CardTitle

APSB26-163

CardDescription

Priority 3 Security update

CardImage

Created

2026-10-13