EUVD-2026-88172
GHSA-h669-gmgf-xwjw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated processing of inbound mail (AV:N/AC:L/PR:N/UI:N); impact is a DMARC policy-enforcement bypass, i.e. integrity-only (I:L), with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domain identifiers that use Unicode full-stop equivalents (such as U+3002 or U+FF0E), which the Domain Handler in policy.c treats as equivalent to the ASCII dot when it should not. Because the flaw sits in the default inbound-milter use case, any MTA running OpenDMARC <=1.4.2 (typically via Postfix or Sendmail) that relies on OpenDMARC verdicts for spoofing decisions is exposed; remote, unauthenticated attackers can send specially crafted mail with no user interaction required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target MTA (Postfix/Sendmail) to run OpenDMARC <=1.4.2 as an inbound milter performing DMARC evaluation on received mail - the default use case for the product. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate priority issue whose real impact is mislabeled by the input metadata. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis, and the vendor did not respond to the disclosure, so remediation must be compensating rather than version-based. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated h
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: a
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC an
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage h
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_polic
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filt
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about t
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today