High severity · published Sep 27, 2026
CVE-2026-100889
Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-one
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDKIM · Trusted Domain Project
2.0; 2.1; 2.2; 2.3; 2.4; 2.5; +6 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100889
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100889
vdb-entry
https://vuldb.com/vuln/410839
signature
https://vuldb.com/vuln/410839/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-100889
third-party-advisory
https://vuldb.com/submit/917063
exploit
https://weitongli.com/share/opendkim-qp-off-by-one.html
More from OpenDKIM
7.3
CVE-2026-100888
Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds write
6.5
CVE-2026-101277
Trusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source