Live › vulnerability › CVE-2026-116739
Go to dashboardVMime's uuEncoder::decode writes uninitialized stack memory into decoded output when a uuencoded line is longer than expected. An attacker who sends a crafted uuencode or x-uuencode MIME part can read up to 15 bytes of stack contents per line in the decoded attachment.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Applications that use VMime to parse email and decode attachments from untrusted senders are exposed, because the leak happens during decoding of a crafted MIME part. Systems that never decode uuencoded attachments, or that only handle mail from trusted sources, can skip it. The sources do not say whether default configurations decode uuencode.
No product ranges from the sources yet.
0.9.2.vmime in dependency manifests and lockfiles.0.9.2 once a fixed release is available; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
This page as .md · .json · in your agent: get_signal("CVE-2026-116739")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.