p PatchFirst

CVE-2026-116738

CVE-2026-116738 · VMime through 0.9.2 Stack-Based Buffer Overflow via uuencode Decoder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.

CVSS 8.7 · High · EPSS 0.7%

Published
Updated

Stack: system

Affected products and versions

  • vmime

    Versions
    • ≥ 0, ≤ 0.9.2: Affected (custom)

    No fix published

  • libvmime Debian:12

    Versions
    • 0.9.2-8
    • 0.9.2-8.1
    • 0.9.2-8.2
    • 0.9.2-8.2~exp1
    • 0.9.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvmime Debian:13

    Versions
    • 0.9.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →