VMime CVE-2026-116739

The target application must use VMime (through 0.9.2) to decode a uuencode or x-uuencode encoded MIME part supplied by the attacker; the attacker crafts that part with a line-length byte larger than the line's actual data so the decoder writes uninitialized stack memory into output. The leak is limited to up to 15 bytes of stack contents per over-long line. The key limiting factor is that the attacker-controlled message must be parsed/decoded by the victim application (UI:P / UI:R) and the leaked bytes must be observable in the resulting decoded attachment; no authentication is required (PR:N).

This is a genuine but low-to-moderate priority information-disclosure flaw (CWE-908), not a high-severity emergency. The signals are consistent and point the same direction: the input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) scores 5.3 (Medium), EPSS is low at 0.25% (17th percentile), and there is no CISA KEV listing, so there is no public evidence of active exploitation. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with a modest-impact confidentiality leak. The one meaningful caveat is the UI:P metric: although the attack vector is network-reachable, exploitation requires the victim application to actually parse/decode an attacker-supplied uuencode MIME part, so this is not a pure zero-interaction remote bug. Impact is bounded - the source diff confirms the flaw leaks only small amounts (up to 15 bytes per over-long line) of uninitialized stack memory into decoded output, which is a disclosure primitive (potentially useful for leaking adjacent secrets or defeating ASLR) rather than code execution. PoC references exist (a hackmd writeup and a VulnCheck advisory) but are not verified as working exploit code, so POC availability should not be read as confirmed exploitation.

An attacker sends an email or other MIME message containing a crafted uuencode or x-uuencode part whose line-length byte is larger than the data the line actually holds. When the target application uses VMime (≤0.9.2) to decode that attachment, the decoder emits uninitialized stack bytes into the decoded output, leaking up to 15 bytes of stack memory per over-long line back to the attacker in the resulting attachment. A public PoC reference exists (hackmd writeup and VulnCheck advisory); it is not verified as working exploit code.