CVE-2026-101015
HighCVSS 7.3Summary
A flaw was found in Trusted Domain Project OpenDMARC up to 1.4.2 in unknown functionality of policy.c in the Domain Handler component. Manipulation leads to improper validation of unsafe equivalence, and the attack can be launched remotely. The exploit has been published and may be used.
Risk Assessment
A remote attacker can leverage the publicly available exploit to bypass DMARC validation, potentially enabling domain spoofing and distribution of forged emails.
Recommendation
Monitor for vendor patches and deploy compensating controls where possible, as the vendor did not respond to the disclosure.
Other vulnerabilities in OpenDMARC
See all- CVE-2026-101017Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-101016Medium
A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.
- CVE-2026-101014High
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2 in the function opendmarc_util_cleanup in libopendmarc/opendmarc_util.c of the DMARC Record Parser component. Manipulation results in an off-by-one, and the attack may be initiated remotely. The exploit is public and the patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae.
- CVE-2026-100891High
Vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2 in the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c of the Internationalized Domain Name Handler component. Manipulation leads to encoding error. Remote attack possible, exploit publicly disclosed.
- CVE-2026-100890Medium
A null pointer dereference vulnerability was found in OpenDMARC up to 1.4.2 in the opendmarc_spf_ipv6_explode function. Manipulating the cp argument causes the issue. The attack can be initiated remotely and the exploit is published.
Original NVD description (English source)
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS