TI-2026-65173 Aliases CVE-2026-101279 GHSA-3h24-2ph8-4r6f

Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow

HIGH 70CWE-189Published 2026-09-29 · Updated 2026-09-29

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00325 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Trusted Domain Project	OpenDMARC	1.4.0; 1.4.1; 1.4.2	—	No fix listed	CNA

OpenDMARC VendorTrusted Domain Project Affected 1.4.0; 1.4.1; 1.4.2 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:trusted_domain_project:opendmarc::::::::	—	—	Trusted Domain Project

cpe:2.3:a:trusted_domain_project:opendmarc:*:*:*:*:*:*:*:* Versions — — ·Trusted Domain Project

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-101279
2026-10-03 Alias added: GHSA-3h24-2ph8-4r6f

References

Exploit 1

https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html

TI-2026-65175 Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication CVSS 4.0MEDIUM 6.9
TI-2026-65174 Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing CVSS 4.0MEDIUM 6.9
TI-2026-65171 Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source CVSS 4.0MEDIUM 6.9
TI-2026-65064 Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65063 Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition CVSS 4.0MEDIUM 6.9
TI-2026-65062 Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input CVSS 4.0MEDIUM 6.9

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences