p PatchFirst

CVE-2026-116739

CVE-2026-116739 · VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder

This page contains facts from public vulnerability sources. Check the original advisory before updating.

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.

CVSS 5.3 · Medium · EPSS 0.3%

Published
Updated

Stack: system

Affected products and versions

  • vmime

    Versions
    • ≥ 0, ≤ 0.9.2: Affected (custom)

    No fix published

  • libvmime Debian:12

    Versions
    • 0.9.2-8
    • 0.9.2-8.1
    • 0.9.2-8.2
    • 0.9.2-8.2~exp1
    • 0.9.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • libvmime Debian:13

    Versions
    • 0.9.2-9
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →