CVE-2026-94184: Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fetchmailto a version that resolves this vulnerability.Patch fetchmail-sa-2026-01
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Fetchmail deployments built with NTLM support are exposed when they connect to a mail server that advertises NTLM authentication. A malicious or compromised server can trigger the flaw remotely.
Does exploitation require credentials, user interaction, or a local foothold?
No privileges or user interaction are required according to the supplied vector. The attacker needs to control, or compromise, a mail server encountered by the affected fetchmail client and provide a crafted NTLM Type 2 challenge.
What can happen if the flaw is triggered?
The crafted challenge can cause a write past a fixed stack buffer while fetchmail builds its NTLM authenticate response. Depending on stack-frame layout and memory hardening, the result may be remote code execution, authentication failure, or fetchmail process termination.