Medium severity · published Sep 29, 2026
CVE-2026-101279
Trusted Domain Project OpenDMARC opendmarc_policy.c integer overflow
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown function of the file libopendmarc/opendmarc_policy.c of the component DMARC Parser. The manipulation of the argument pct leads to integer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenDMARC · Trusted Domain Project
1.4.0; 1.4.1; 1.4.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101279
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101279
vdb-entry
https://vuldb.com/vuln/411036
signature
https://vuldb.com/vuln/411036/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101279
third-party-advisory
https://vuldb.com/submit/918280
exploit
https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html
More from OpenDMARC
7.3
CVE-2026-101281
Trusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication
7.3
CVE-2026-101280
Trusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing
7.3
CVE-2026-101015
Trusted Domain Project OpenDMARC policy.c improper validation of unsafe equivalence in input
7.3
CVE-2026-101014
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
7.3
CVE-2026-100891
Trusted Domain Project OpenDMARC Internationalized Domain Name opendmarc_policy.c opendmarc_policy_query_dmarc encoding error