The vulnerability resides in the dkim_process_set function of the Tag Tokenizer component in Trusted Domain Project OpenDKIM. By manipulating set directives, a remote attacker can cause the daemon to treat input as coming from a less trusted source, thereby bypassing intended trust checks. The flaw can be exploited over the network, and a public exploit is available, meaning attackers can compromise email authentication and potentially subvert the OpenDKIM trust model. The description explicitly states that the attack may be initiated remotely, so remote access is a required condition.

Trusted Domain Project OpenDKIM versions up to 2.11.0 are affected. All releases of OpenDKIM before 2.12.0 contain the unpatched Tag Tokenizer component and are vulnerable.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Because a public exploit exists and the attack can be carried out remotely, the likelihood of exploitation is higher than the metrics suggest. Attackers can trigger the flaw from any network connection that reaches the OpenDKIM service, leading to bypass of trust boundaries and possible escalation of privileges on the mail server. The description explicitly states the attack can be initiated remotely, confirming remote access is needed.