CVE-2026-94184: Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
A flaw was found in fetchmail. A stack-based buffer overflow exists in the NTLM client authentication code (ntlmhelper() / buildSmbNtlmAuthResponse() in smbutil.c) when fetchmail is built with --enable-NTLM. The AddBytes macro copies data from a server-supplied NTLM Type 2 challenge into a fixed 1024-byte stack buffer without validating remaining capacity. A malicious or compromised mail server that advertises NTLM can overwrite a few dozen bytes past the buffer. Depending on compiler stack-frame layout, this may allow remote code execution; otherwise the practical impact is authentication failure or process abort under stack hardening. Affects fetchmail 5.0.8 through 6.6.6. Fixed in 6.6.7 (commit cb5be5c38471eec19e519ace0bc569176317ea92). Red Hat Enterprise Linux builds enable NTLM and ship affected versions.
Other sources
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fetchmailto a version that resolves this vulnerability.Fixed in 6.6.7Patch cb5be5c38471eec19e519ace0bc569176317ea92
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Fetchmail deployments built with NTLM support are exposed when they connect to a mail server that advertises NTLM authentication. A malicious or compromised server can trigger the flaw remotely.
Does exploitation require credentials, user interaction, or a local foothold?
No privileges or user interaction are required according to the supplied vector. The attacker needs to control, or compromise, a mail server encountered by the affected fetchmail client and provide a crafted NTLM Type 2 challenge.
What can happen if the flaw is triggered?
The crafted challenge can cause a write past a fixed stack buffer while fetchmail builds its NTLM authenticate response. Depending on stack-frame layout and memory hardening, the result may be remote code execution, authentication failure, or fetchmail process termination.