Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_util_cleanup in the library libopendmarc/opendmarc_util.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Trusted Domain Project | OpenDMARC | 1.4.0; 1.4.1; 1.4.2 | — | No fix listed | CNA |
- OpenDMARC VendorTrusted Domain Project Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* | — | — | Trusted Domain Project |
- cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* Versions — — ·Trusted Domain Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2026-101014
- 2026-10-03 Alias added: GHSA-ccpv-xp3h-j99v
References
More Trusted Domain Project vulnerabilities
- TI-2026-65175 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication CVSS 4.0MEDIUM 6.9
- TI-2026-65174 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing CVSS 4.0MEDIUM 6.9
- TI-2026-65173 Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow CVSS 4.0MEDIUM 6.9
- TI-2026-65171 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source CVSS 4.0MEDIUM 6.9
- TI-2026-65064 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition CVSS 4.0MEDIUM 6.9
- TI-2026-65063 Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-101014 · CVE Program
- CVE-2026-101014 · NVD
- FIRST EPSS
- GHSA-ccpv-xp3h-j99v · GitHub Advisory Database · CC BY 4.0
- CVE-2026-101014 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences