UBUNTU-CVE-2026-116739: Medium severity ubuntu/libvmime vulnerability
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that process attacker-supplied uuencode or x-uuencode MIME parts using VMime through 0.9.2 are exposed. The affected Ubuntu software package is libvmime.
What does an attacker need to exploit it?
An attacker needs to deliver a crafted MIME part containing an over-long uuencoded line with a large line-length byte. The CVSS vector indicates network reachability, no required privileges, and user interaction.
What is the expected impact of successful exploitation?
Successful exploitation can disclose up to 15 bytes of uninitialized stack memory for each affected decoded attachment line. The provided CVSS metrics indicate confidentiality impact only, with no stated integrity or availability impact.