Medium severity · published Sep 28, 2026
CVE-2026-101017
Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDMARC · Trusted Domain Project
1.4.0; 1.4.1; 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101017
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101017
vdb-entry
https://vuldb.com/vuln/410887
signature
https://vuldb.com/vuln/410887/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101017
third-party-advisory
https://vuldb.com/submit/918247
exploit
https://xuyongzhe-vt.github.io/share/opendmarc-subdomain-walk-abort.html
More from OpenDMARC
7.3
CVE-2026-101281
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
7.3
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
7.3
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
7.3
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
7.3
CVE-2026-100891
Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error