CVE-2026-101016CWE-755

CVE-2026-101016

Medium · published September 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00324 · 24.3th percentile
Weakness
CWE-755 · Improper Handling of Exceptional Conditions
Published
2026-09-28T13:17Z
References (5)
https://vuldb.com/cve/CVE-2026-101016 · [email protected]https://vuldb.com/submit/918242 · [email protected]https://vuldb.com/vuln/410886 · [email protected]https://vuldb.com/vuln/410886/cti · [email protected]https://xuyongzhe-vt.github.io/share/opendmarc-bad-tag-drops-policy.html · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 28 SEP 08:45Z
    Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition
    cvelistv5