TI-2026-65063 Aliases CVE-2026-101016 GHSA-qr8p-83rg-g68h

Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition

HIGH 70CWE-755Published 2026-09-28 · Updated 2026-09-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00325 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Trusted Domain Project	OpenDMARC	1.4.0; 1.4.1; 1.4.2	—	No fix listed	CNA

OpenDMARC VendorTrusted Domain Project Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trusted_domain_project:opendmarc::::::::	—	—	Trusted Domain Project

cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* Versions — — ·Trusted Domain Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-101016
2026-10-03 Alias added: GHSA-qr8p-83rg-g68h

References

Exploit 1

https://xuyongzhe-vt.github.io/share/opendmarc-bad-tag-drops-policy.html

TI-2026-65175 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-65174 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing CVSS 4.0MEDIUM 6.9
TI-2026-65173 Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow CVSS 4.0MEDIUM 6.9
TI-2026-65171 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source CVSS 4.0MEDIUM 6.9
TI-2026-65064 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65062 Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input CVSS 4.0MEDIUM 6.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences