CVE-2026-100895CWE-404CWE-476

CVE-2026-100895

Medium · published September 28, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.0.0.Beta0 is recommended to address this issue. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00671 · 51.4th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-09-28T06:17Z
References (6)
https://github.com/trusteddomainproject/OpenARC/releases/tag/v1.0.0.Beta0 · [email protected]https://vuldb.com/cve/CVE-2026-100895 · [email protected]https://vuldb.com/submit/917187 · [email protected]https://vuldb.com/vuln/410845 · [email protected]https://vuldb.com/vuln/410845/cti · [email protected]https://weitongli.com/share/openarc-c-tag-null-deref.html · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 1%
    epss
  • 28 SEP 01:15Z
    Trusted Domain Project OpenARC libopenarc arc-canon.c arc_parse_canon_t null pointer dereference
    cvelistv5