CVE-2026-116738
CVE-2026-116738 · VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
CVSS 8.7 · Alta · EPSS 0,7%
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
vmime
- Versiones
- ≥ 0, ≤ 0.9.2: Afectada (custom)
Sin corrección publicada
libvmime Debian:12
- Versiones
- 0.9.2-8
- 0.9.2-8.1
- 0.9.2-8.2
- 0.9.2-8.2~exp1
- 0.9.2-9
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
libvmime Debian:13
- Versiones
- 0.9.2-9
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
Fuentes originales
- https://github.com/kisli/vmime/pull/363
- https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
- https://github.com/kisli/vmime
- https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L185-L190
- https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write
- https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-overflow-via-uuencode-decoder
- https://nvd.nist.gov/vuln/detail/CVE-2026-116738