CVE-2026-116739: VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using VMime through version 0.9.2 are exposed when they decode attacker-controlled uuencode or x-uuencode MIME parts. The vulnerable behavior occurs while producing decoded attachment output.
What does an attacker need to do to exploit it?
An attacker needs to send a crafted MIME part encoded as uuencode or x-uuencode with a large line-length byte. Exploitation requires user interaction, as reflected by the UI:R vector.
What information can be disclosed?
The decoded attachment output can contain uninitialized stack memory. Up to 15 bytes of stack contents may be leaked for each over-long encoded line.
How can I determine whether my deployment is affected?
Check whether the application uses VMime version 0.9.2 or earlier and processes uuencode or x-uuencode MIME attachments. The issue is associated with the uuEncoder::decode function.