Log in Start free

Vulnerability · Published Sep 28, 2026 · Assigned by VulDB

CVE-2026-101014Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

High 7.3

In plain English

A high-severity security flaw in OpenDMARC from Trusted Domain Project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12opendmarcno fix listedDEBIAN-CVE-2026-101014
Debian:13opendmarcno fix listedDEBIAN-CVE-2026-101014
Debian:14opendmarcno fix listedDEBIAN-CVE-2026-101014
Ubuntu:22.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-101014
Ubuntu:24.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-101014
Ubuntu:26.04:LTSopendmarcno fix listedUBUNTU-CVE-2026-101014
Ubuntu:26.10opendmarcno fix listedUBUNTU-CVE-2026-101014

Affected products (as reported)

VendorProductVersions
Trusted Domain Project OpenDMARC 1.4.01.4.11.4.2

Weakness: CWE-193, CWE-189 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References