A flaw exists in the opendmarc_util_cleanup routine of OpenDMARC’s DMARC Record parser, where an off‑by‑one error causes an improperly sized buffer during cleanup of authority and policy strings. The vulnerability can be triggered by providing malformed DMARC records, potentially overwriting adjacent memory and allowing an attacker to influence program behaviour. The result may be a denial of service or, in the worst case, arbitrary code execution if the overwritten bytes control critical data such as function pointers or return addresses. The weak code path is rooted in improper bounds checking and buffer management, reflecting the weaknesses identified by CWE‑189 and CWE‑193.

OpenDMARC versions up to and including 1.4.2 shipped by the Trusted Domain Project are affected. Older releases prior to 1.4.2 are not known to contain the flaw and newer releases contain the patch supplied by commit b3b1da9264bc80324094a27c71e7369bdedc62ae.

The CVSS score of 6.9 positions the vulnerability as medium‑to‑high severity, and its remote exploitation potential is confirmed by the description. Although the EPSS score is not available, the public disclosure of the exploit and the fact that the flaw can be triggered via remote DMARC records raise concern. The vulnerability is not listed in the CISA KEV catalog, but the available evidence suggests that exploitation is feasible and the risk to systems that process DMARC records is non‑negligible.