CVE-2026-100890: Trusted Domain Project OpenDMARC SPF Parser opendmarc_spf.c opendmarc_spf_ipv6_explode null pointer dereference
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcspfipv6explode in the library libopendmarc/opendmarcspf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered affected?
OpenDMARC versions up to and including 1.4.2 are identified as affected. The vulnerable code is in the libopendmarc SPF parser component.
Does an attacker need credentials or user interaction to trigger the issue?
No. The vulnerability is remotely initiable, and the supplied CVSS vector indicates no privileges or user interaction are required.
Is public exploit information available?
Yes. An exploit has been published and may be used.
What is the expected security impact?
The supplied CVSS assessment indicates a low availability impact, with no identified confidentiality or integrity impact.
Is a vendor response or fix identified in the available information?
No vendor response is reported. The available information does not identify a vendor-provided fix or mitigation.