https://seclists.org/oss-sec/2026/q3/880: CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to mote code execution in NTLM authentication client (vised fetchmail-SA-2026-01)

Q: Which deployments should be prioritized for remediation?

Prioritize fetchmail 6.6.6 and older where the build has NTLM authentication enabled. The issue affects only some NTLM-enabled builds, rather than every fetchmail installation.

Q: Is the issue limited to a crash, or can it lead to code execution?

The maintainer revised the earlier assessment after the reporter identified circumstances in which NTLM-enabled builds may be exploitable. In the worst case, the impact is remote code execution.

Q: Which release contains the code fix?

Fetchmail 6.6.7 fixed the vulnerable NTLM client code and added buffer-size checks. Fetchmail 6.6.8 was subsequently released with corrected security-announcement documentation and additional non-security changes.

Published Sep 23, 2026

Updated

Affected Software

1 affected component

Fetchmail Fetchmail<=6.6.6

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Prioritize fetchmail 6.6.6 and older where the build has NTLM authentication enabled. The issue affects only some NTLM-enabled builds, rather than every fetchmail installation.

Is the issue limited to a crash, or can it lead to code execution?

The maintainer revised the earlier assessment after the reporter identified circumstances in which NTLM-enabled builds may be exploitable. In the worst case, the impact is remote code execution.

Which release contains the code fix?

Fetchmail 6.6.7 fixed the vulnerable NTLM client code and added buffer-size checks. Fetchmail 6.6.8 was subsequently released with corrected security-announcement documentation and additional non-security changes.