A flaw in VMime 0.9.2’s uuEncoder::decode function allows uninitialized stack memory to be written to the decoded output when a uuencoded line is longer than expected. An attacker sending a crafted uuencode or x‑uuencode MIME part can leak up to 15 bytes of stack contents for each line processed, providing a small but potentially useful data fragment to an adversary.

The VMime library version 0.9.2 and earlier from the kisli:vmime vendor are vulnerable. Applications that use this library to parse uuencoded MIME parts are the only affected systems.

With a CVSS score of 5.3, this vulnerability is considered moderate in severity. The EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation. The likely attack vector is via a malicious MIME part received by software that decodes uuencoded content, such as email clients or other message processors. The leakage is small (15 bytes per line) but could assist an attacker in further compromising the system if additional vulnerabilities are present.