This vulnerability is an integer underflow in VMime's uuEncoder::decode function that triggers a stack‑based buffer overflow when a crafted uuencoded MIME part is processed. A remote attacker can send an email containing a uuencoded line whose length character is 'b' but is not prefixed with a proper "begin" line, corrupting stack memory. The overflow can crash the application or, if the attacker can control execution flow, execute arbitrary code. This weakness is classified as CWE‑121.

The affected product is the VMime library produced by kisli, with vulnerable versions through 0.9.2. Any application or service that incorporates VMime to parse or generate MIME messages may be impacted, including email clients, servers, and middleware that rely on this library for attachment handling. The public repositories indicate that the bug has been identified in the source code of version 0.9.2.

The CVSS score is 8.7, reflecting a high severity due to the potential for remote code execution. The EPSS score is not available but the vulnerability has not been listed in CISA's KEV catalog. Based on the description, the likely attack vector is remote via an email that contains maliciously crafted uuencoded data; the attacker must be able to deliver the message to a system that processes the encoded part. The combination of high impact and the remote nature of the exploit makes this a significant risk for exposed or loosely filtered mail processing environments.