---
id: "CVE-2026-116739"
kind: "vulnerability"
aliases: ["CVE-2026-116739"]
title: "VMime: uuencode decoder leaks stack memory into decoded attachments"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["c++", "email-parsing", "package", "self-hosted", "vmime"]
not_affected_if: ["no-uuencode-decoding", "trusted-mail-only"]
published_at: "2026-10-26T22:16:58+00:00"
first_seen_at: "2026-10-26T22:25:34+00:00"
updated_at: "2026-10-26T22:28:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116739", "first_seen_at": "2026-10-26T22:25:34+00:00"}]
---

# VMime: uuencode decoder leaks stack memory into decoded attachments

VMime's uuEncoder::decode writes uninitialized stack memory into decoded output when a uuencoded line is longer than expected. An attacker who sends a crafted uuencode or x-uuencode MIME part can read up to 15 bytes of stack contents per line in the decoded attachment.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the VMime version in use; the sources say it affects releases through `0.9.2`.
- Search the codebase for `vmime` in dependency manifests and lockfiles.
- Confirm whether the application decodes uuencoded MIME parts from untrusted mail.

## Fix

- Upgrade VMime past `0.9.2` once a fixed release is available; the sources do not name a fixed version.
- Until then, reject or strip uuencode and x-uuencode MIME parts before decoding.

## Timeline

- 2026-10-26T22:25:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116739

## From the sources

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_