Medium severity · published Sep 28, 2026
CVE-2026-101016
Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional condition
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_policy_parse_dmarc in the library libopendmarc/opendmarc_policy.c. The manipulation of the argument fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to handling of exceptional conditions. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDMARC · Trusted Domain Project
1.4.0; 1.4.1; 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101016
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101016
vdb-entry
https://vuldb.com/vuln/410886
signature
https://vuldb.com/vuln/410886/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101016
third-party-advisory
https://vuldb.com/submit/918242
exploit
https://xuyongzhe-vt.github.io/share/opendmarc-bad-tag-drops-policy.html
More from OpenDMARC
7.3
CVE-2026-101281
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
7.3
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
7.3
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
7.3
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
7.3
CVE-2026-100891
Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error