p PatchFirst

CVE-2026-94184

CVE-2026-94184 · Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

CVSS 5.3 · Medium · EPSS 1.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • red hat enterprise linux 10

    Versions
    • ≥ 0:6.4.38-3.el10_2.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 8

    Versions
    • ≥ 0:6.4.24-1.el8_10.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 9

    Versions
    • ≥ 0:6.4.24-1.el9_8.1: Not affected (rpm)

    No fix published

  • red hat enterprise linux 6

    No fix published

  • red hat enterprise linux 7

    No fix published

  • fetchmail Debian:12

    Versions
    • 6.4.37-1
    • 6.4.38-1
    • 6.4.39-1
    • 6.5.6-1
    • 6.5.6-2
    • 6.5.7-1
    • 6.6.0-1
    • 6.6.1-1
    • 6.6.2-1
    • 6.6.2-2
    • 6.6.2-3
    • 6.6.3-1
    • 6.6.3-2
    • 6.6.3-3
    • 6.6.6-1
    • 6.6.8-1
    • 6.6.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Debian:13

    Versions
    • 6.4.39-1
    • 6.5.6-1
    • 6.5.6-2
    • 6.5.7-1
    • 6.6.0-1
    • 6.6.1-1
    • 6.6.2-1
    • 6.6.2-2
    • 6.6.2-3
    • 6.6.3-1
    • 6.6.3-2
    • 6.6.3-3
    • 6.6.6-1
    • 6.6.8-1
    • 6.6.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Debian:14

    Versions
    • 6.4.39-1
    • 6.5.6-1
    • 6.5.6-2
    • 6.5.7-1
    • 6.6.0-1
    • 6.6.1-1
    • 6.6.2-1
    • 6.6.2-2
    • 6.6.2-3
    • 6.6.3-1
    • 6.6.3-2
    • 6.6.3-3
    • 6.6.6-1
    Affected ranges
    • ECOSYSTEM: < 6.6.8-1

    Update to 6.6.8-1

  • fetchmail Ubuntu:16.04:LTS

    Versions
    • 6.3.26-1
    • 6.3.26-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:18.04:LTS

    Versions
    • 6.3.26-3
    • 6.3.26-3build1
    • 6.3.26-3ubuntu0.1~18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:20.04:LTS

    Versions
    • 6.4.0~rc4-1ubuntu1
    • 6.4.1-1ubuntu1
    • 6.4.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:22.04:LTS

    Versions
    • 6.4.22-1
    • 6.4.23-1
    • 6.4.24-1
    • 6.4.25-1
    • 6.4.26-1
    • 6.4.27-1
    • 6.4.27-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:24.04:LTS

    Versions
    • 6.4.37-1
    • 6.4.38-1ubuntu1
    • 6.4.38-1ubuntu3
    • 6.4.38-1ubuntu4
    • 6.4.38-1ubuntu4.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:26.10

    Versions
    • 6.6.2-2
    • 6.6.3-3
    • 6.6.6-1
    • 6.6.6-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • fetchmail Ubuntu:26.04:LTS

    Versions
    • 6.5.4-0ubuntu2
    • 6.5.4-0ubuntu3
    • 6.6.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →