The vulnerability lies in the opendmarc_policy_parse_dmarc function of Trusted Domain Project OpenDMARC up to version 1.4.2. When an attacker supplies crafted values for policy tags such as fo, rf, ri, pct, sp, adkim, aspf, rua, or ruf, the parser mistakenly processes an exceptional condition, an issue identified as CWE-1286 and CWE-755. This flaw can be triggered remotely through policy data received from the network, enabling the attacker to cause unexpected behavior or a denial of service within the OpenDMARC library.

The affected products are all releases of Trusted Domain Project OpenDMARC up to version 1.4.2, specifically the libopendmarc/opendmarc_policy.c module. Systems that load DMARC policies from untrusted sources or accept policy tags from external senders are at risk. The vulnerability does not affect other components of OpenDMARC.

Risk assessment shows a CVSS score of 6.9, indicating medium to high severity. EPSS data is not available, so the current probability of exploitation remains unknown. The vulnerability is not listed in CISA KEV. This flaw can be triggered remotely by embedding malicious policy tags in DMARC records accessible over the Internet. An unauthenticated attacker who can influence the policy data, such as through DNS TXT records or compromised mail servers, could potentially exploit the exceptional condition to cause errors in policy parsing that may degrade DMARC enforcement or lead to further compromise.