OpenDKIM EUVD-2026-88052

Requires OpenDKIM (<=2.11.0) deployed as a DKIM milter that verifies/processes inbound mail, so the attacker-controlled DKIM-Signature header - specifically the h= signed-headers tag - reaches dkim_canon_selecthdrs during canonicalization. No authentication, no user interaction, and default milter configurations that verify inbound signatures are affected; the practical limiting factor is that OpenDKIM must be in the mail path performing DKIM canonicalization on received messages, and the primary demonstrated impact is memory corruption (likely milter crash / mail-flow DoS) rather than confirmed code execution.

This is a CWE-787 out-of-bounds write in OpenDKIM's dkim_canon_selecthdrs header-selection routine, reachable remotely and unauthenticated (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) because a DKIM milter processes attacker-controlled inbound DKIM-Signature headers, including the h= tag that drives header canonicalization. The vendor CVSS 4.0 of 6.9 rates all impacts Low (VC/VI/VA:L), which arguably understates a memory-corruption primitive - an OOB write can plausibly cause milter crashes (mail-flow DoS) and, depending on heap layout, more serious corruption. Publicly available exploit code exists (weitongli write-up), but there is NO EPSS score and NO CISA KEV listing, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. The E:P (Proof-of-Concept) exploit maturity in the vector is consistent with 'POC exists, not weaponized.' The most important limiting factor is that OpenDKIM is effectively unmaintained (2.11.0 is the last release, ~2015) and the vendor did not respond to disclosure, so no official patch is expected - defenders relying on distro backports or migration to alternatives (e.g., rspamd) should plan accordingly. Net: a genuine, remotely-reachable memory-safety bug in mail infrastructure that merits attention, but current real-world exploitation risk is moderate rather than urgent absent KEV/EPSS signals.

An attacker sends an email to a mail server running OpenDKIM as a verification milter, embedding a crafted DKIM-Signature header whose h= (signed-headers) tag is manipulated to drive an out-of-bounds write during header canonicalization/selection. No authentication or user interaction is required since inbound mail is processed automatically. Public proof-of-concept exploit code exists demonstrating the OOB write, most reliably resulting in a crash of the milter (mail-flow disruption).