CVE-2026-101014
HighCVSS 7.3Summary
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2 in the function opendmarc_util_cleanup in libopendmarc/opendmarc_util.c of the DMARC Record Parser component. Manipulation results in an off-by-one, and the attack may be initiated remotely. The exploit is public and the patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae.
Risk Assessment
A remote attacker can use the public exploit to trigger an off-by-one error, potentially leading to memory corruption or a crash of the DMARC record processing service.
Recommendation
Deploy patch b3b1da9264bc80324094a27c71e7369bdedc62ae or upgrade OpenDMARC to a version containing this fix.
Other vulnerabilities in OpenDMARC
See all- CVE-2026-101017Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-101016Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-101015High
A flaw was found in Trusted Domain Project OpenDMARC up to 1.4.2 in unknown functionality of policy.c in the Domain Handler component. Manipulation leads to improper validation of unsafe equivalence, and the attack can be launched remotely. The exploit has been published and may be used.
- CVE-2026-100891High
Vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 in the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c of the Internationalized Domain Name Handler component. Manipulation leads to encoding error. Remote attack possible, exploit publicly disclosed.
- CVE-2026-100890Medium
A null pointer dereference vulnerability was found in OpenDMARC up to 1.4.2 in the opendmarc_spf_ipv6_explode function. Manipulating the cp argument causes the issue. The attack can be initiated remotely and the exploit is published.
Original NVD description (English source)
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS