{"id":"CVE-2026-116739","kind":"vulnerability","aliases":["CVE-2026-116739"],"related":[],"title":"VMime: uuencode decoder leaks stack memory into decoded attachments","description":"VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.","summary":"VMime's uuEncoder::decode writes uninitialized stack memory into decoded output when a uuencoded line is longer than expected. An attacker who sends a crafted uuencode or x-uuencode MIME part can read up to 15 bytes of stack contents per line in the decoded attachment.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","email-parsing","package","self-hosted","vmime"],"not_affected_if":["no-uuencode-decoding","trusted-mail-only"],"how_to_check":"- Check the VMime version in use; the sources say it affects releases through `0.9.2`.\n- Search the codebase for `vmime` in dependency manifests and lockfiles.\n- Confirm whether the application decodes uuencoded MIME parts from untrusted mail.","fix":"- Upgrade VMime past `0.9.2` once a fixed release is available; the sources do not name a fixed version.\n- Until then, reject or strip uuencode and x-uuencode MIME parts before decoding.","status":"open","published_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:28:01+00:00","updated_at":"2026-10-26T22:28:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:28:01Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade VMime past `0.9.2` once a fixed release is available; the sources do not name a fixed version.\n- Until then, reject or strip uuencode and x-uuencode MIME parts before decoding.","reach":"network","title":"VMime: uuencode decoder leaks stack memory into decoded attachments","impact":"low","summary":"VMime's uuEncoder::decode writes uninitialized stack memory into decoded output when a uuencoded line is longer than expected. An attacker who sends a crafted uuencode or x-uuencode MIME part can read up to 15 bytes of stack contents per line in the decoded attachment.","category":"package","nicknames":[],"who_cares":["c++","vmime","email-parsing","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Up to 15 bytes of stack memory leak per line into attachments","analyst_note":"Find the fixed VMime version and confirm whether default builds decode uuencoded MIME parts; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116739 for the advisory link.","how_to_check":"- Check the VMime version in use; the sources say it affects releases through `0.9.2`.\n- Search the codebase for `vmime` in dependency manifests and lockfiles.\n- Confirm whether the application decodes uuencoded MIME parts from untrusted mail.","needs_analyst":true,"not_affected_if":["no-uuencode-decoding","trusted-mail-only"],"who_is_affected":"Applications that use VMime to parse email and decode attachments from untrusted senders are exposed, because the leak happens during decoding of a crafted MIME part. Systems that never decode uuencoded attachments, or that only handle mail from trusted sources, can skip it. The sources do not say whether default configurations decode uuencode.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000673,"input_tokens":3338,"output_tokens":679,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116739':12A,15A '-2026':11A,14A '0.9.2':74C '15':61B,120C 'attach':9A,71B,129C 'attack':45B,98C 'byte':62B,115C,121C 'c':16B 'contain':75C 'content':65B,124C 'craft':49B,102C 'cve':10A,13A 'decod':3A,8A,28B,34B,70B,83C,91C,128C 'disclosur':78C 'email':18B 'email-pars':17B 'expect':43B 'function':84C 'host':23B 'inform':77C 'larg':112C 'leak':4A,117C 'length':114C 'line':39B,67B,97C,113C,126C 'long':96C 'longer':41B 'memori':6A,32B,89C 'mime':55B,108C 'output':35B,92C 'over-long':94C 'packag':20B 'pars':19B 'part':56B,109C 'per':66B,125C 'read':58B 'self':22B 'self-host':21B 'send':47B,100C 'stack':5A,31B,64B,88C,123C 'uniniti':30B,87C 'uuencod':2A,27B,38B,50B,54B,82C,103C,107C 'vmime':1A,24B,25B,72C 'vulner':79C 'write':29B,86C 'x':53B,106C 'x-uuencod':52B,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that use VMime to parse email and decode attachments from untrusted senders are exposed, because the leak happens during decoding of a crafted MIME part. Systems that never decode uuencoded attachments, or that only handle mail from trusted sources, can skip it. The sources do not say whether default configurations decode uuencode.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116739","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116739","severity":null,"published_at":"2026-10-26T22:16:58+00:00","modified_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}