{"id":"CVE-2026-116738","kind":"vulnerability","aliases":["CVE-2026-116738"],"related":[],"title":"VMime: crafted uuencoded email part overflows stack, may run code","description":"VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.","summary":"VMime, a C++ mail library, has an integer underflow in its uuencode decoder that causes a stack-based buffer overflow when it parses a crafted uuencoded MIME part. An attacker who sends an email to an application using VMime can crash the application or potentially execute code.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","mail-parsing","package","self-hosted","vmime"],"not_affected_if":["no-inbound-mime-parsing","no-vmime-dependency"],"how_to_check":"- unknown","fix":"- Move to a VMime release newer than `0.9.2` once a fixed version is published; the sources do not name one.","status":"open","published_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:30+00:00","updated_at":"2026-10-26T22:27:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a VMime release newer than `0.9.2` once a fixed version is published; the sources do not name one.","reach":"internet","title":"VMime: crafted uuencoded email part overflows stack, may run code","impact":"high","summary":"VMime, a C++ mail library, has an integer underflow in its uuencode decoder that causes a stack-based buffer overflow when it parses a crafted uuencoded MIME part. An attacker who sends an email to an application using VMime can crash the application or potentially execute code.","category":"package","nicknames":[],"who_cares":["c++","vmime","mail-parsing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote email triggers stack corruption, crash or possible code execution","analyst_note":"Confirm the fixed VMime version and which downstream products bundle VMime; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116738 is the only source.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-vmime-dependency","no-inbound-mime-parsing"],"who_is_affected":"Applications that link VMime through 0.9.2 and parse inbound MIME email, such as mail clients, mail gateways or mail-processing services, are exposed when they decode uuencoded parts. The sources do not say which products bundle VMime, so teams should check whether their build or vendored dependencies include it. Systems that do not parse inbound email with VMime can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000613,"input_tokens":3346,"output_tokens":557,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116738':13A,16A '-2026':12A,15A '0.9.2':76C 'allow':87C 'applic':63B,69B,129C 'attack':56B,89C,103C 'b':116C 'base':44B,95C 'begin':121C 'buffer':45B,96C 'c':17B,28B 'caus':40B 'charact':114C 'code':10A,73B,133C 'contain':77C 'corrupt':123C 'craft':2A,51B,99C 'crash':67B,127C 'cve':11A,14A 'decod':38B,84C 'email':4A,60B,107C 'execut':72B,132C 'function':85C 'host':24B 'integ':33B,79C 'length':113C 'librari':30B 'line':111C,122C 'mail':19B,29B 'mail-pars':18B 'may':8A 'memori':125C 'mime':53B,101C 'overflow':6A,46B,97C 'packag':21B 'pars':20B,49B 'part':5A,54B,102C 'potenti':71B,131C 'remot':88C 'run':9A 'self':23B 'self-host':22B 'send':58B,105C 'stack':7A,43B,94C,124C 'stack-bas':42B,93C 'trigger':91C 'underflow':34B,80C 'use':64B 'uuencod':3A,37B,52B,83C,100C,110C 'via':98C 'vmime':1A,25B,26B,65B,74C 'whose':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that link VMime through 0.9.2 and parse inbound MIME email, such as mail clients, mail gateways or mail-processing services, are exposed when they decode uuencoded parts. The sources do not say which products bundle VMime, so teams should check whether their build or vendored dependencies include it. Systems that do not parse inbound email with VMime can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116738","severity":null,"published_at":"2026-10-26T22:16:58+00:00","modified_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}