CVE-2026-100890
Received Received - Intake

OpenDMARC SPF Parser Null Pointer Dereference Vulnerability

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the function opendmarc_spf_ipv6_explode in the library libopendmarc/opendmarc_spf.c of the component SPF Parser. This manipulation of the argument cp causes null pointer dereference. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100890
EUVD
EUVD-2026-88054

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trusted_domain_project opendmarc to 1.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100890 is a NULL pointer dereference flaw in OpenDMARC's SPF parser function opendmarc_spf_ipv6_explode. It occurs when processing malformed IPv6 literals in SPF records, causing the parser to crash by dereferencing a NULL pointer. The issue is triggered remotely by an attacker sending a message from a domain with a specially crafted SPF record containing a short IPv6 literal.

Detection Guidance

To detect this vulnerability, monitor OpenDMARC logs for crashes or segmentation faults during SPF record processing. Check if your OpenDMARC version is 1.4.2 or earlier. Use AddressSanitizer to identify NULL pointer dereferences in the opendmarc_spf_ipv6_explode function.

Impact Analysis

This vulnerability can cause denial of DMARC and SPF evaluation, potentially disrupting mail delivery depending on the milter's failure mode. The service may crash when processing certain emails, leading to service unavailability for legitimate users.

Mitigation Strategies

Upgrade OpenDMARC to a patched version if available. If using a vulnerable build, recompile with a fix that adds a NULL check in the IPv6 segment expansion loop. Disable SPF parsing if not critical by avoiding --with-spf flag during compilation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart