High severity · published Sep 28, 2026
CVE-2026-100891
Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_query_dmarc in the library libopendmarc/opendmarc_policy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDMARC · Trusted Domain Project
1.4.0; 1.4.1; 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-100891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-100891
vdb-entry
https://vuldb.com/vuln/410841
signature
https://vuldb.com/vuln/410841/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-100891
third-party-advisory
https://vuldb.com/submit/917215
exploit
https://weitongli.com/share/opendmarc-ulabel-not-converted.html
More from OpenDMARC
7.3
CVE-2026-101281
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
7.3
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
7.3
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
7.3
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
6.5
CVE-2026-101279
Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow