A vulnerability has been identified in the Trusted Domain Project OpenDMARC component that allows an integer overflow when the pct argument in the file opendmarc_policy.c is manipulated. The overflow can lead to memory corruption inside the DMARC Parser, potentially enabling an attacker to execute arbitrary code or cause a denial of service. This vulnerability is exploitable remotely via crafted DMARC messages.

The flaw affects all releases of Trusted Domain Project OpenDMARC up to version 1.4.2. No specific sub‑versions are listed, so any installation falling under this range is considered vulnerable.

The vulnerability carries a CVSS score of 6.9, indicating a moderate severity. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, but public disclosure has already occurred. The attack vector is inferred to be remote, relying on malicious DMARC data that can be sent over the network, and the exploit is available publicly, increasing the likelihood of real‑world attacks. Without a vendor patch, the risk remains significant.