CVE-2026-100890CWE-404CWE-476

CVE-2026-100890

Medium · published September 28, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00372 · 30.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-09-28T05:16Z
References (5)
https://vuldb.com/cve/CVE-2026-100890 · [email protected]https://vuldb.com/submit/917188 · [email protected]https://vuldb.com/vuln/410840 · [email protected]https://vuldb.com/vuln/410840/cti · [email protected]https://weitongli.com/share/opendmarc-ip6-wild-pointer.html · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 00:00Z
    Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference
    cvelistv5