Live › vulnerability › CVE-2026-116738
Go to dashboardVMime, a C++ mail library, has an integer underflow in its uuencode decoder that causes a stack-based buffer overflow when it parses a crafted uuencoded MIME part. An attacker who sends an email to an application using VMime can crash the application or potentially execute code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that link VMime through 0.9.2 and parse inbound MIME email, such as mail clients, mail gateways or mail-processing services, are exposed when they decode uuencoded parts. The sources do not say which products bundle VMime, so teams should check whether their build or vendored dependencies include it. Systems that do not parse inbound email with VMime can skip this.
No product ranges from the sources yet.
0.9.2 once a fixed version is published; the sources do not name one.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
This page as .md · .json · in your agent: get_signal("CVE-2026-116738")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.