Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by VulDB

CVE-2026-100890Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference

Medium 5.3

In plain English

A medium-severity null pointer dereference in OpenDMARC from Trusted Domain Project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 68.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12opendmarcno fix listedDEBIAN-CVE-2026-100890
Debian:13opendmarcno fix listedDEBIAN-CVE-2026-100890
Debian:14opendmarcno fix listedDEBIAN-CVE-2026-100890
Ubuntu:22.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-100890
Ubuntu:24.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-100890
Ubuntu:26.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-100890
Ubuntu:26.10opendmarcno fix listedUBUNTU-CVE-2026-100890

Affected products (as reported)

VendorProductVersions
Trusted Domain Project OpenDMARC 1.4.01.4.11.4.2

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References