High severity · published Sep 28, 2026
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDMARC · Trusted Domain Project
1.4.0; 1.4.1; 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101015
vdb-entry
https://vuldb.com/vuln/410885
signature
https://vuldb.com/vuln/410885/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101015
third-party-advisory
https://vuldb.com/submit/917216
exploit
https://weitongli.com/share/opendmarc-unicode-dot-bypass.html
More from OpenDMARC
7.3
CVE-2026-101281
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
7.3
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
7.3
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
7.3
CVE-2026-100891
Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error
6.5
CVE-2026-101279
Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow