CVE-2026-116738
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unscored. Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
- CVSS 4.0
- 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-121
- Source
- disclosure@vulncheck.com
References
- https://github.com/kisli/vmime
- https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L185-L190
- https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
- https://github.com/kisli/vmime/pull/363
- https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write
- https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-overflow-via-uuencode-decoder
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.