EUVD-2026-88059
GHSA-w7f9-3mm4-6cr5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted email to target MTA
-
ExploitMilter parses malformed ARC c= tag
-
ExecutionNULL dereference in arc_parse_canon_t
-
ImpactOpenARC milter process crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that OpenARC (Trusted Domain Project's ARC milter, version up to 1.0.0.Beta1) be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail. Exploitation is remote and unauthenticated: the attacker only needs to deliver an email containing a crafted ARC canonicalization (c=) tag that reaches the milter's arc_parse_canon_t parser. The main limiting factor is deployment scarcity - OpenARC is beta-stage, optional mail-authentication software with a small footprint; impact is confined to availability (crash/DoS of the milter), with no confidentiality or integrity consequence. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, but every impact metric except availability is None (VC:N/VI:N/VA:L) - this is a pure denial-of-service NULL-pointer dereference, not code execution or data exposure. The vendor score of 6.9 is inflated by the E:P (proof-of-concept exploit exists) threat modifier; the base availability-only impact realistically maps to CVSS 3.1 ~5.3 (A:L). No EPSS score and no CISA KEV listing are provided, and publicly available exploit code exists (weitongli.com) but that is distinct from active exploitation - there is no evidence this is being exploited in the wild. Net: a real but modest issue - a remote unauthenticated crash of a mail-authentication milter - that is priority-relevant only where OpenARC is actually deployed inbound. The description is internally CONTRADICTORY: it lists affected versions 'up to 1.0.0.Beta1' yet recommends 'upgrading to version 1.0.0.Beta0,' which the GitHub release notes identify as the INITIAL public release (i.e. older than Beta1). This fix/affected-version guidance cannot be reconciled from the data and must be verified with the vendor. |
| Exploit ScenarioDerived | An attacker sends a crafted inbound email whose ARC canonicalization header carries a malformed c= (canonicalization) tag; when the OpenARC milter parses it in arc_parse_canon_t, a NULL pointer dereference crashes the filter, disrupting mail flow for a Postfix/Sendmail server. Public proof-of-concept exploit code is available, and the attack requires no authentication or user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
A NULL pointer dereference in the Trusted Domain Project's OpenARC ARC milter (affected versions up to and including 1.0.0.Beta1) allows a remote, unauthenticated sender to crash the milter by delivering an email whose ARC canonicalization (c=) tag causes arc_parse_canon_t in libopenarc/arc-canon.c to dereference a NULL pointer. Publicly available exploit code exists, but the impact is confined to availability - the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reported CVSS 4.0 vector both carry no confidentiality or integrity consequence, so this is a pure denial-of-service condition, not code execution or data exposure. Exploitation requires that OpenARC be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail, which limits real-world exposure given the product's beta-stage, optional mail-authentication footprint.
RemediationAI
The primary fix is to upgrade OpenARC to the vendor-recommended release, which the advisory and the patch reference identify as version 1.0.0.Beta0 (https://github.com/trusteddomainproject/OpenARC/releases/tag/v1.0.0.Beta0); because that version string is lower than the stated affected version 1.0.0.Beta1, confirm with the Trusted Domain Project that the tagged release actually contains the arc_parse_canon_t fix, or move to the latest available upstream build, before treating the issue as resolved. Until the upgrade is validated, treat the patch as 'available per vendor advisory' rather than confirmed. As compensating controls where patching is not immediately possible: (1) run the OpenARC milter under a supervisor or MTA configuration that automatically restarts the milter process on crash (e.g., systemd Restart=always or Postfix content-filter supervision) - this preserves mail flow but leaves a window of degraded ARC validation and repeated log noise, and if the milter failure causes the MTA to defer or reject mail, queue growth is possible; (2) temporarily disable inbound ARC validation in the milter configuration so that crafted ARC-Seal/ARC-Message-Signature headers are not parsed - this removes the attack surface entirely but sacrifices ARC chain verification, degrading downstream authentication results for forwarded mail; (3) restrict which mail reaches the milter, for example by refusing or stripping messages from untrusted relays at the MTA edge - this narrows exposure but is impractical for an internet-facing inbound gateway, which is precisely the deployment scenario at risk. Monitor for milter crashes correlated with inbound messages carrying non-standard ARC canonicalization tags, since the public proof-of-concept at https://weitongli.com/share/openarc-c-tag-null-deref.html demonstrates the crash condition and no public exploit has been reported as actively exploited.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenARC is the Trusted Domain Project's implementation of the ARC (Authenticated Received Chain) protocol, delivered as a milter that plugs into MTAs such as Postfix and Sendmail to add and validate ARC header sets on inbound messages. The vulnerable code path is arc_parse_canon_t in the libopenarc library file arc-canon.c, which parses the canonicalization (c=) parameter of an ARC-Seal or ARC-Message-Signature header; a crafted value that the parser does not handle causes a NULL pointer to be dereferenced. This maps to CWE-476 (NULL Pointer Dereference), a memory-safety class that typically results in a process crash rather than memory corruption or execution primitives. The CPE entry cpe:2.3:a:trusted_domain_project:openarc:*:*:*:*:*:*:*:* confirms the affected component is the trusted_domain_project:openarc package itself (all versions per the feed), with the vulnerable library shipped as libopenarc. Because the fault is triggered during header parsing of an unsolicited inbound message, the reachable attack surface is any MTA instance wired to the milter, with no credential or prior session required per the vector's PR:N.
Know when Openarc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remote unauthenticated crafted-email trigger gives AV:N/AC:L/PR:N/UI:N; a NULL-deref milter crash is availability-only (A:L), no C/I impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.0.0.Beta0 is recommended to address this issue. Upgrading the affected component is advised.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB