CVE-2026-94184
Received Received - Intake

Stack-Based Buffer Overflow in Fetchmail with NTLM Support

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: redhat-SADP

Description
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94184
EUVD
EUVD-2026-83923

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
fetchmail fetchmail *
fetchmail fetchmail From 5.0.8 (inc) to 6.6.6 (inc)
fetchmail fetchmail to 6.6.6 (inc)
fetchmail fetchmail 6.6.7
fetchmail fetchmail 6.6.7.rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-94184 is a stack-based buffer overflow in fetchmail when built with NTLM support. A malicious mail server can send a crafted NTLM Type 2 challenge that causes fetchmail to write past a fixed 1024-byte stack buffer while building the NTLM response. This may lead to remote code execution depending on stack layout or cause crashes due to memory hardening.

Detection Guidance

To detect this vulnerability, check if fetchmail is installed and if it was compiled with NTLM support. Run 'fetchmail --version' to see the version. If using versions 5.0.8 through 6.6.6, it may be vulnerable. Check compilation flags with 'strings $(which fetchmail) | grep NTLM' or inspect build logs for '--enable-NTLM'.

Impact Analysis
  • Remote code execution by overwriting stack memory if conditions are met.
  • Authentication failure or process termination due to stack protection mechanisms.
  • Compromise of email retrieval system if NTLM is enabled and server is malicious.
Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Remote code execution may result in data breaches, requiring breach notifications under these regulations.

Mitigation Strategies

Immediately upgrade fetchmail to version 6.6.7 or later. Alternatively, disable NTLM by recompiling without '--enable-NTLM' or using '--disable-NTLM'. If upgrading is not possible, avoid using NTLM authentication by specifying an alternative with '--auth <mechanism>'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94184. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart