CVE-2026-101279

Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A vulnerability has been identified in the Trusted Domain Project OpenDMARC component that allows an integer overflow when the pct argument in the file opendmarc_policy.c is manipulated. The overflow can lead to memory corruption inside the DMARC Parser, potentially enabling an attacker to execute arbitrary code or cause a denial of service. This vulnerability is exploitable remotely via crafted DMARC messages.

Affected Systems

The flaw affects all releases of Trusted Domain Project OpenDMARC up to version 1.4.2. No specific sub‑versions are listed, so any installation falling under this range is considered vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, but public disclosure has already occurred. The attack vector is inferred to be remote, relying on malicious DMARC data that can be sent over the network, and the exploit is available publicly, increasing the likelihood of real‑world attacks. Without a vendor patch, the risk remains significant.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Trusted Domain Project OpenDMARC to a version newer than 1.4.2 if a fix has been released.
  • If an upgrade is not immediately possible, enforce strict input validation on the pct field so that only values between 0 and 100 are accepted, thereby preventing the integer overflow condition.
  • As a temporary measure, filter or reject DMARC messages that contain out‑of‑range pct values, and monitor DMARC logs for anomalous activity.

Generated by OpenCVE AI on September 29, 2026 at 02:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow
First Time appeared Trusted Domain Project
Trusted Domain Project opendmarc
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*
Vendors & Products Trusted Domain Project
Trusted Domain Project opendmarc
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 10:48 AM
Reserved
Sep 28, 2026, 11:52 AM

View source JSON

Updated
Sep 29, 2026, 10:48 AM

JSON

Status
Deferred
Published
Sep 29, 2026, 1:16 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 29, 2026, 2:30 AM

JSON