EUVD-2026-88167
GHSA-ccpv-xp3h-j99v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated parsing of inbound email (AV:N/AC:L/PR:N/UI:N); a single-byte NUL off-by-one realistically yields DoS and minor corruption (I:L/A:L), no meaningful disclosure (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
AnalysisAI
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a crafted message that causes the DMARC record parser's opendmarc_util_cleanup routine to write one byte past the end of a buffer; publicly available exploit code exists. The practical impact is narrow - the overflow is a single NUL byte, so the realistic outcome is a crash or denial of service rather than controllable memory corruption, which aligns with the independently assessed CVSS:3.1 vector (C:N/I:L/A:L). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to run OpenDMARC <=1.4.2 as a DMARC-checking milter on an internet-facing mail server (Postfix/Sendmail), such that attacker-influenced input reaches opendmarc_util_cleanup during DMARC record parsing. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L, base 6.9) describes a remote, low-complexity, unauthenticated flaw with low impact across confidentiality, integrity, and availability, plus E:P (proof-of-concept exploit maturity). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix, which is available as commit b3b1da9264bc80324094a27c71e7369bdedc62ae (referenced in the vendor-tracked patch data), delivered via GitHub PR https://github.com/trusteddomainproject/OpenDMARC/pull/188 and PR https://github.com/trusteddomainproject/OpenDMARC/pull/344; because these are PR/commit-level fixes, treat this as 'Upstream fix available (PR/commit); released patched version not independently confirmed' and verify whether a tagged OpenDMARC release bundles the change before relying on a package upgrade - if not, rebuild libopendmarc from the patched commit. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse
OpenDMARC 1.4.2 contains a null pointer dereference vulnerability in /OpenDMARC/libopendmarc/opendmarc_policy.c. Rated h
OpenDMARC 1.4.1 and 1.4.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and applicati
OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with multiple From: a
Email authentication bypass in OpenDMARC up to 1.4.2 allows remote unauthenticated attackers to spoof sender domains by
DMARC authentication bypass in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote attacker defeat the DMARC an
Integer overflow in OpenDMARC through 1.4.2 allows unauthenticated remote attackers to corrupt DMARC policy-percentage h
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domai
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_polic
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filt
OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false information about t
Same weakness CWE-193 – Off-by-one Error
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today