EUVD-2026-88053
GHSA-87hw-mmxf-r6m3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft email with malformed quoted-printable DKIM field
-
DeliveryDeliver message to OpenDKIM-protected MTA
-
Exploitdkim_qp_decode off-by-one triggered during verification
-
ExecutionOut-of-bounds byte read/write
-
ImpactLimited disclosure or process disruption
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Numeric handling
|
| Exploitation Conditions | Requires that OpenDKIM (version up to 2.11.0) is deployed as a verifying milter on an internet-facing MTA (Postfix or Sendmail) so that inbound, attacker-controlled mail reaches the dkim_qp_decode quoted-printable decoding path - this is the standard OpenDKIM verification configuration, so no non-default setting is needed. No authentication and no user interaction are required (PR:N/UI:N); the limiting factor is that the target must actually run OpenDKIM in a verification role, and the impact per the vendor is bounded (single-byte off-by-one, all impacts rated Low) rather than reliable code execution. |
| Impact | The VulDB-assigned CVSS 4.0 base score is 5.5 (medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L - remote, unauthenticated, low complexity, with low-magnitude confidentiality, integrity and availability impact. The E:P (Proof-of-Concept) exploit-maturity metric aligns with the stated public exploit at weitongli.com. There is NO EPSS score and NO CISA KEV listing in the provided data, so there is no evidence of active or widespread exploitation - publicly available exploit code exists but exploitation is not confirmed in the wild. CWE-189 (numeric errors) combined with an off-by-one in a quoted-printable decoder points to a single-byte memory-safety defect; the vendor's decision to rate all three impact dimensions as only Low suggests a bounded off-by-one (likely a one-byte over-read or over-write) rather than full memory corruption leading to RCE, which tempers the raw AV:N/PR:N profile. The 'Information Disclosure' tag conflicts with a memory-corruption/off-by-one root cause and with the presence of VI:L/VA:L (not just confidentiality). Net: a real but modest issue - the unauthenticated remote reachability of the DKIM verification path warrants patching where OpenDKIM verifies inbound mail, but the low technical impact and absence of EPSS/KEV signals argue against emergency prioritization. |
| Exploit ScenarioDerived | An attacker sends an email through a mail server that runs OpenDKIM (as a Postfix/Sendmail milter) with a crafted DKIM-Signature or related field containing malformed quoted-printable data. When OpenDKIM's dkim_qp_decode routine in util.c decodes the input, the off-by-one is triggered during normal inbound verification, requiring no authentication or user interaction. A public proof-of-concept is documented at weitongli.com, describing the quoted-printable off-by-one. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
An off-by-one error in OpenDKIM's quoted-printable decoder (dkim_qp_decode in util.c) affects all releases up to and including 2.11.0 and is reachable by remote, unauthenticated attackers who can deliver mail to a host running OpenDKIM as a verifying milter. The flaw is triggered while decoding attacker-controlled message bodies, producing low-magnitude confidentiality, integrity and availability impact rather than reliable code execution, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Publicly available exploit code exists, and the vendor was contacted before disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
RemediationAI
No vendor-released patch has been identified at time of analysis: the Trusted Domain Project did not respond to the pre-disclosure contact, and none of the supplied references point to a tagged fixed release, commit, or vendor advisory with an exact patched version, so there is no version number to upgrade to and none should be assumed. Because the flaw is exposed only when attacker-controlled mail reaches the QP decoder, the most effective compensating control is to stop using OpenDKIM as the inbound verifier until a fix appears and switch verification to an actively maintained alternative such as Rspamd or a comparable DKIM verifier, leaving OpenDKIM in place only for outbound signing; the trade-off is a second milter/daemon stack to operate and tune, plus potential differences in DKIM evaluation results. If OpenDKIM must remain the inbound verifier, restrict exposure by running the milter in a dedicated, least-privileged process or container with a strict seccomp/ASLR-hardened profile and file-system confinement, and front the MTA with upstream filtering so untrusted QP-encoded bodies are less likely to reach it; this reduces the blast radius of an out-of-bounds access but does not remove the bug and adds operational complexity. Continue monitoring https://vuldb.com/vuln/410839 and the researcher write-up for an upstream fix, and treat the presence of public exploit code as a reason to prioritize whichever mitigation is chosen.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenDKIM is the Trusted Domain Project's DKIM implementation, most commonly deployed as a milter that Postfix or Sendmail invokes to verify inbound signatures (and sign outbound mail) using the DKIM protocol. As part of verification it must canonicalize message headers and bodies, and for messages using quoted-printable transfer encoding it invokes the decoder dkim_qp_decode in util.c to expand QP sequences such as =3D and soft line breaks before hashing. The vulnerability is an off-by-one error, mapped to CWE-189 (Numeric Errors, off-by-one class), meaning a boundary computation on a buffer or index is one unit short, so a crafted QP-encoded message body can drive a read or write one byte past the intended limit. Reachability requires only that inbound, attacker-controlled mail traverse the verification path; no authentication, user interaction, or non-default configuration is needed beyond running OpenDKIM in its standard verification role. The limited magnitude of the resulting out-of-bounds access is why the assessed impact is Low across confidentiality, integrity and availability rather than a code-execution rating.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable inbound DKIM verification with no auth or interaction (AV:N/AC:L/PR:N/UI:N); a bounded off-by-one yields limited disclosure, integrity and availability impact (C:L/I:L/A:L), no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB