CVE-2026-101014 Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
MediumCVSS 6.9
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trusted domain project opendmarc | = 1.4.0 | No fix listed |
| trusted domain project opendmarc | = 1.4.1 | No fix listed |
| trusted domain project opendmarc | = 1.4.2 | No fix listed |
| debian/opendmarc(Debian:12) | All versions | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-2 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-3 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-4 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-4.1 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-4.1~exp1 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-5 | No fix listed |
| debian/opendmarc(Debian:12) | = 1.4.2-5.1 | No fix listed |
| debian/opendmarc(Debian:13) | All versions | No fix listed |
| debian/opendmarc(Debian:13) | = 1.4.2-5 | No fix listed |
| debian/opendmarc(Debian:13) | = 1.4.2-5.1 | No fix listed |
| debian/opendmarc(Debian:14) | All versions | No fix listed |
| debian/opendmarc(Debian:14) | = 1.4.2-5 | No fix listed |
| debian/opendmarc(Debian:14) | = 1.4.2-5.1 | No fix listed |
| ubuntu/opendmarc(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/opendmarc(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/opendmarc(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/opendmarc(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2542368 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- github.com issue-tracking patch
- github.com issue-tracking patch
- CVE-2026-101014 | CVE Analysis and Report third-party-advisory
- Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read third-party-advisory
- VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one technical-description vdb-entry
- VDB-410884 | CTI Indicators (IOB, IOC, IOA) permissions-required signature
- weitongli.com exploit
- Debian Security Tracker CVE-2026-101014 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- bugs.debian.org issue-tracking