CVE-2026-101014: Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarcutilcleanup in the library libopendmarc/opendmarcutil.c of the component DMARC Record Parser. Performing a manipulation results in off-by-one. The attack may be initiated remotely. The exploit is now public and may be used. The patch is named b3b1da9264bc80324094a27c71e7369bdedc62ae. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trusted Domain Project OpenDMARCto a version that resolves this vulnerability.Patch b3b1da9264bc80324094a27c71e7369bdedc62ae
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
OpenDMARC deployments running versions up to 1.4.2 should be prioritized, particularly systems that process DMARC records exposed to remote input. The issue is in the DMARC Record Parser within libopendmarc.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction. The vulnerability can be triggered remotely through manipulation of parser input.
Is exploit code available?
Yes. The vulnerability information states that a public exploit is available and may be used.
What remediation is identified?
Deploy the patch identified as b3b1da9264bc80324094a27c71e7369bdedc62ae. The provided information does not identify an alternative mitigation for environments that cannot patch immediately.