CVE-2026-94184

Awaiting Analysis Awaiting Analysis - Queue

Stack-Based Buffer Overflow in Fetchmail with NTLM Support

Publication date: 2026-09-21

Last updated on: 2026-11-06

Assigner: redhat-SADP

Description

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-11-06

Generated

2026-11-08

AI Q&A

2026-09-21

EPSS Evaluated

2026-11-07

NVD

CVE-2026-94184

EUVD

EUVD-2026-83923

Affected Vendors & Products

Vendor	Product	Version / Range
fetchmail	fetchmail	*
fetchmail	fetchmail	From 5.0.8 (inc) to 6.6.6 (inc)
fetchmail	fetchmail	to 6.6.6 (inc)
fetchmail	fetchmail	6.6.7
fetchmail	fetchmail	6.6.7.rc1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

CVE-2026-94184 is a stack-based buffer overflow in fetchmail when built with NTLM support. A malicious mail server can send a crafted NTLM Type 2 challenge that causes fetchmail to write past a fixed 1024-byte stack buffer while building the NTLM response. This may lead to remote code execution depending on stack layout or cause crashes due to memory hardening.

Detection Guidance

To detect this vulnerability, check if fetchmail is installed and if it was compiled with NTLM support. Run 'fetchmail --version' to see the version. If using versions 5.0.8 through 6.6.6, it may be vulnerable. Check compilation flags with 'strings $(which fetchmail) | grep NTLM' or inspect build logs for '--enable-NTLM'.

Impact Analysis

Remote code execution by overwriting stack memory if conditions are met.
Authentication failure or process termination due to stack protection mechanisms.
Compromise of email retrieval system if NTLM is enabled and server is malicious.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Remote code execution may result in data breaches, requiring breach notifications under these regulations.

Mitigation Strategies

Immediately upgrade fetchmail to version 6.6.7 or later. Alternatively, disable NTLM by recompiling without '--enable-NTLM' or using '--disable-NTLM'. If upgrading is not possible, avoid using NTLM authentication by specifying an alternative with '--auth <mechanism>'.

Hi! I’m here to help you understand CVE-2026-94184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...