OpenDMARC CVE-2026-101017

Requires the target to run Trusted Domain Project OpenDMARC (<=1.4.2) as a DMARC-checking milter in front of Postfix/Sendmail, processing inbound mail. Exploitation is remote and unauthenticated (PR:N) because the attacker only needs to control their own sending domain's DMARC DNS record or craft a sending (sub)domain name that triggers the exceptional condition in the strcasecmp subdomain-walk logic; no credentials on the mail server are needed. The practical limiting factor is that impact is confined to DMARC policy evaluation (bypass/abort) with no confidentiality exposure and no code execution - value to an attacker is spoofing/phishing that evades DMARC, and only sites depending on OpenDMARC for anti-spoofing enforcement are affected.

This is a HIGH-prevalence-product but LOW-to-MEDIUM real-world-priority issue. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:N/VI:L/VA:L, E:P) scores 5.5 and models a remote, unauthenticated, low-complexity flaw with low integrity and availability impact and NO confidentiality impact - the E:P (Proof-of-Concept) exploit maturity matches the description's claim that a public exploit exists. There is NO EPSS score and NO CISA KEV listing provided, so exploitation is 'publicly available exploit code exists' but NOT confirmed actively exploited; treat POC-availability and active-exploitation as distinct. The CWE-755 (improper handling of exceptional conditions) plus the reference title 'opendmarc-subdomain-walk-abort' indicates a crafted domain aborts OpenDMARC's org-domain/subdomain policy walk in strcasecmp handling, yielding DMARC evaluation bypass (integrity) and/or a processing abort (availability) rather than data disclosure - this directly contradicts the 'Information Disclosure' tag (VC:N confirms no confidentiality impact). Net: a legitimate but low-severity mail-authentication-bypass class bug in an unmaintained product; not an emergency, but worth patching/mitigating for organizations relying on OpenDMARC for anti-spoofing.

An attacker who controls a sending domain publishes a crafted DMARC TXT record (or sends mail from a specially named subdomain) that triggers the exceptional condition in OpenDMARC's strcasecmp-based subdomain policy walk. The milter aborts or mishandles the policy lookup, so a message that should be quarantined/rejected under the domain's DMARC policy is instead allowed through. A public proof-of-concept exists (xuyongzhe-vt), demonstrating the subdomain-walk abort remotely and without authentication.