CVE-2026-101014

HIGH 7.3

Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.

CWE	CWE-193 CWE-189
Vendor	trusted domain project
Product	opendmarc
Published	Sep 28, 2026

Stay Ahead of the Next One

Get instant alerts for trusted domain project opendmarc

Be the first to know when new high vulnerabilities affecting trusted domain project opendmarc are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Trusted Domain Project / OpenDMARC

1.4.0 1.4.1 1.4.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/410884 vuldb.com: https://vuldb.com/vuln/410884/cti vuldb.com: https://vuldb.com/cve/CVE-2026-101014 vuldb.com: https://vuldb.com/submit/917100 github.com: https://github.com/trusteddomainproject/OpenDMARC/pull/188 github.com: https://github.com/trusteddomainproject/OpenDMARC/pull/344 weitongli.com: https://weitongli.com/share/opendmarc-cleanup-off-by-one.html github.com: https://github.com/trusteddomainproject/OpenDMARC/commit/b3b1da9264bc80324094a27c71e7369bdedc62ae

Credits

🔍 WeitongLi (VulDB User)