CVE-2026-116739
VMime through 0.9.2 Uninitialized Stack Memory Disclosure via uuencode Decoder
kisli vmime
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Text from CVE List
Affected versions 1
- vmimeaffected: all versions through 0.9.2CVE List
References 6
- github.com/kisli/vmime/pull/363Fixvia CVE List
- github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8Fixvia CVE List
- hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-writeAdvisoryvia CVE List
- vulncheck.com/advisories/vmime-through-0.9.2-uninitialized-stack-memory-disclosure-via-uuencode-decoderAdvisoryvia CVE List
- github.com/kisli/vmimeReferencevia CVE List
- github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L311Referencevia CVE List