EUVD-2026-110486
GHSA-rhj9-fcgr-5r62
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft email with malformed uuencoded part
-
DeliveryDeliver message to victim mailbox
-
ExploitApplication decodes uuencoded MIME part
-
ExecutionInteger underflow in uuEncoder::decode
-
PersistStack-based buffer overflow corrupts memory
-
ImpactCrash or arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target application must use VMime (≤0.9.2) to decode uuencoded MIME content, and an attacker must get a crafted message parsed - specifically a uuencoded line whose length character is 'b' on a line that is not a valid 'begin' marker, which triggers the integer underflow during the 'begin'/'end' marker probe. Exploitation is remote and unauthenticated (PR:N) but requires passive user interaction (UI:P): the victim or their mail software must actually process/decode the message. Limiting factors: only applications that invoke VMime's uuencode decoder on untrusted input are exposed, the product footprint is small, and reliable code execution (versus a crash) is not demonstrated in the available evidence. |
| Impact | Signals are moderately consistent and point to a real-but-not-emergency priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VC:H/VI:H/VA:H, score 8.7) describes a network-reachable, low-complexity flaw needing only passive user interaction (the victim's mail application parsing a crafted message) with total confidentiality/integrity/availability impact on the vulnerable system. SSVC tempers this: Exploitation is 'none' (no observed active exploitation), Automatable is 'yes', and Technical Impact is 'total' - matching the vuln.today 'this_week' priority rather than an immediate-action label. EPSS is low at 0.73% (54th percentile), and the vulnerability is NOT in CISA KEV, so there is no confirmed widespread or targeted exploitation; the low EPSS is consistent with the niche footprint of the affected library rather than a contradiction. The signals do not conflict, but note that 'total technical impact' and 'VI/VA:H' reflect potential code execution from a stack overflow, while the description itself states the overflow may 'crash the application or potentially execute code' - i.e. reliable RCE is asserted as possible, not demonstrated. |
| Exploit ScenarioDerived | An attacker sends an email containing a crafted uuencoded MIME part in which a line's length character is 'b' but the line is not a valid 'begin' line. When a victim application built on VMime decodes that part, an integer underflow in uuEncoder::decode drives a stack-based buffer overflow, crashing the process or potentially executing attacker-controlled code. A public PoC reference exists (hackmd write-up and VulnCheck advisory); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
VMime 0.9.2 and earlier contain an integer underflow in uuEncoder::decode that turns a crafted uuencoded MIME part into a stack-based buffer overflow, letting remote attackers crash a mail-processing application or potentially corrupt memory toward code execution. The trigger is a uuencoded line whose length character is 'b' but which is not a valid 'begin' marker: the marker probe consumes more bytes than the short line accounts for, the remaining-length subtraction wraps to a huge value, and the decode loop then writes past its fixed-size stack buffer. Exploitation requires that the target application feeds untrusted uuencoded content to VMime's decoder and that a victim or their mail software actually processes the message (network-reachable, unauthenticated, requires user interaction); no active exploitation is confirmed (SSVC exploitation: none), EPSS is a modest 0.73% (54th percentile), and while an upstream fix exists in PR/commit form, a public technical writeup exists that is not verified as working exploit code.
RemediationAI
Apply the upstream fix in VMime PR #363 (commit e85925eddc638939f0eeb7ee55ec047d04a760d8) and rebuild every application or mail-handling service that links the library; the patch clamps the decoded line length to 48 bytes, recomputes inLength as ((outLength + 2) / 3) * 4, and adds an inPos > inLength guard that blocks the underflow entirely, plus bounds corrections in inputStreamStringAdapter and seekableInputStreamRegionAdapter. Because the fix is published as a pull request and commit rather than a confirmed tagged release, verify against your vendor or distribution package versions before assuming a binary is patched, and cite https://github.com/kisli/vmime/pull/363 and https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-overflow-via-uuencode-decoder in change records. Where rebuilding is not immediately possible, reduce exposure by disabling or rejecting uuencode-encoded MIME parts at the mail gateway or by ensuring application code paths do not pass untrusted content to VMime's uuencode decoder, accepting the trade-off that legitimate uuencoded attachments (an obsolete but still occasionally seen encoding) will fail to be decoded and that any non-decoding path bypasses the vulnerable code only as long as it is actually enforced; do not rely on such filtering as a permanent substitute for the patched decoder, since the underlying malformed-line condition can also arrive through nested or re-encoded MIME content.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
VMime is a C++ MIME/mail library (CPE cpe:2.3:a:kisli:vmime:*:*:*:*:*:*:*:*, all versions through 0.9.2), and the flaw sits in src/vmime/utility/encoder/uuEncoder.cpp in the classic uuencode decoder. Uuencoded payloads are line-oriented: each data line begins with a length character whose value (character minus space, masked to 6 bits) states how many source bytes the line represents, and the decoder derives both an output length (UUDECODE(lengthChar)) and an input length (std::min((outLength * 4) / 3, 64)) from it. A line whose length character is 'b' but that is not preceded by a proper 'begin' marker causes the begin/end marker probe to read ahead five bytes before giving up, so the probe position ends up larger than the computed input length for that line; the subsequent 'inLength - inPos' subtraction is performed on size_t and underflows to an enormous value, producing an out-of-bounds write into a fixed-size stack buffer (CWE-121, stack-based buffer overflow). The offered upstream patch (PR #363, commit e85925eddc638939f0eeb7ee55ec047d04a760d8) addresses the root cause in two ways: it clamps the decoded length to at most 48 bytes and recomputes the input length as ((outLength + 2) / 3) * 4 so the encoded line always fits, and it inserts an explicit 'if (inPos > inLength) break;' guard before the decode loop so the underflow can no longer occur. The same PR also corrects bounds logic in inputStreamStringAdapter::read/reset and seekableInputStreamRegionAdapter::read, replacing overflow-prone 'm_pos + count >= m_end' comparisons with a computed 'remaining' value and bounding std::copy against m_end rather than m_buffer.end(). The identical decoding path is reachable from message parsing APIs, which is why the exposure is tied to applications that parse attacker-supplied MIME content rather than to VMime in isolation.
Know when Vmime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Crafted email is network-delivered and parsed with no attacker privileges (AV:N/AC:L/PR:N), but requires the victim application to decode it (UI:R); stack overflow yields potential code execution, so C/I/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
Executive ViewAI
VMime, a widely used email parsing library, contains a high-severity stack-based buffer overflow (CVE-2026-116738) that can be triggered by a specially crafted uuencoded MIME part. Any mail-processing application using VMime 0.9.2 or earlier is affected, and exploitation requires a user to open or process a malicious email, potentially leading to crashes or memory corruption. Leadership should prioritize patching because email is a primary attack vector, and the flaw could disrupt mail services or, in worst-case scenarios, enable code execution.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Exploit-DB