CVE-2026-100889: Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkimqpdecode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which installations should be treated as affected?
Trusted Domain Project OpenDKIM installations up to and including version 2.11.0 should be treated as affected where the Decoder component is in use.
Does an attacker need credentials or user interaction to exploit this issue?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected security impact if exploitation succeeds?
The reported severity vector indicates low impact to confidentiality, integrity, and availability. A public exploit is reported to exist.