CVE-2026-101014

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-101014", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-09-27T11:32:56.615Z", "datePublished": "2026-09-28T08:15:13.249Z", "dateUpdated": "2026-09-28T12:43:21.470Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T08:15:13.249Z"}, "title": "Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-193", "lang": "en", "description": "Off-by-One"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-189", "lang": "en", "description": "Numeric Error"}]}], "affected": [{"vendor": "Trusted Domain Project", "product": "OpenDMARC", "versions": [{"version": "1.4.0", "status": "affected"}, {"version": "1.4.1", "status": "affected"}, {"version": "1.4.2", "status": "affected"}], "cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "modules": ["DMARC Record Parser"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-09-27T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-09-27T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-09-27T13:38:17.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "WeitongLi (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/410884", "name": "VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/410884/cti", "name": "VDB-410884 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101014", "name": "CVE-2026-101014 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/917100", "name": "Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/pull/188", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/pull/344", "tags": ["issue-tracking", "patch"]}, {"url": "https://weitongli.com/share/opendmarc-cleanup-off-by-one.html", "tags": ["exploit"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae", "tags": ["patch"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202609"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-28T12:43:08.404808Z", "id": "CVE-2026-101014", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T12:43:21.470Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-101014", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-28T12:43:08.404808Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-28T12:43:17.655Z"}}], "cna": {"tags": ["x_open-source"], "title": "Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one", "credits": [{"lang": "en", "type": "reporter", "value": "WeitongLi (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 7.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "vendor": "Trusted Domain Project", "modules": ["DMARC Record Parser"], "product": "OpenDMARC", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}]}], "timeline": [{"lang": "en", "time": "2026-09-27T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-09-27T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-09-27T13:38:17.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/410884", "name": "VDB-410884 | Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/410884/cti", "name": "VDB-410884 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-101014", "name": "CVE-2026-101014 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/917100", "name": "Submit #917100 | The Trusted Domain Project OpenDMARC 1.4.2 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/pull/188", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/pull/344", "tags": ["issue-tracking", "patch"]}, {"url": "https://weitongli.com/share/opendmarc-cleanup-off-by-one.html", "tags": ["exploit"]}, {"url": "https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae", "tags": ["patch"]}], "x_generator": ["VulDB PVTS v202609"], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-193", "description": "Off-by-One"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-189", "description": "Numeric Error"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-09-28T08:15:13.249Z"}}}, "cveMetadata": {"cveId": "CVE-2026-101014", "state": "PUBLISHED", "dateUpdated": "2026-09-28T12:43:21.470Z", "dateReserved": "2026-09-27T11:32:56.615Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-09-28T08:15:13.249Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:*"], "modules": ["DMARC Record Parser"], "product": "OpenDMARC", "vendor": "Trusted Domain Project", "versions": [{"status": "affected", "version": "1.4.0"}, {"status": "affected", "version": "1.4.1"}, {"status": "affected", "version": "1.4.2"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch."}], "id": "CVE-2026-101014", "lastModified": "2026-09-28T15:15:33.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101014", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-28T12:43:08.404808Z", "version": "2.0.3"}}]}, "published": "2026-09-28T09:17:03.893", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae"}, {"source": "cna@vuldb.com", "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/188"}, {"source": "cna@vuldb.com", "url": "https://github.com/trusteddomainproject/OpenDMARC/pull/344"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-101014"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/917100"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410884"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/410884/cti"}, {"source": "cna@vuldb.com", "url": "https://weitongli.com/share/opendmarc-cleanup-off-by-one.html"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-189"}, {"lang": "en", "value": "CWE-193"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "opendmarc: OpenDMARC: Denial of Service via off-by-one error in opendmarc_util_cleanup", "id": "2542368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2542368"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-193", "details": ["A flaw was found in OpenDMARC. An off-by-one boundary error exists in the DMARC (Domain-based Message Authentication, Reporting, and Conformance) record parser during cleanup operations in the opendmarc_util_cleanup function. A remote attacker could exploit this vulnerability by submitting specially crafted records, potentially leading to a Denial of Service (DoS) or memory corruption."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-101014", "public_date": "2026-09-28T08:15:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-101014\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101014\nhttps://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae\nhttps://github.com/trusteddomainproject/OpenDMARC/pull/188\nhttps://github.com/trusteddomainproject/OpenDMARC/pull/344\nhttps://vuldb.com/cve/CVE-2026-101014\nhttps://vuldb.com/submit/917100\nhttps://vuldb.com/vuln/410884\nhttps://vuldb.com/vuln/410884/cti\nhttps://weitongli.com/share/opendmarc-cleanup-off-by-one.html"], "statement": "OpenDMARC is not shipped in any Red Hat product. It is available only in Fedora and EPEL community repositories.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.4.2"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OpenDMARC", "source": "cna", "vendor": "Trusted Domain Project"}, "product": "opendmarc", "vendor": "trusted_domain_project"}], "created": "2026-09-28T09:30:14.379221+00:00", "updated": "2026-09-28T10:00:11.118268+00:00", "vendors": ["trusted_domain_project", "trusted_domain_project$PRODUCT$opendmarc"]}