CVE-2026-116739 Details
Description
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
A vulnerability allowing information disclosure has been identified in VMime versions through 0.9.2. The issue resides in the uuEncoder::decode function, where uninitialized stack memory is written into the decoded output for overly long lines. Attackers can exploit this by sending a crafted uuencode or x-uuencode MIME part with a large line length byte, potentially leaking up to 15 bytes of stack contents per line in the decoded attachments.
Users can update to VMime version 0.9.2 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/kisli/vmime | [email protected] | ProductSource CodeVendor |
| https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L311 | [email protected] | Source CodeVendor |
| https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8 | [email protected] | Source CodeVendor |
| https://github.com/kisli/vmime/pull/363 | [email protected] | Issue TrackingVendor |
| https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write | [email protected] | ExploitTechnical Analysis |
| https://www.vulncheck.com/advisories/vmime-through-0.9.2-uninitialized-stack-memory-disclosure-via-uuencode-decoder | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-908 | Use of Uninitialized Resource | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| VMime | <= 0.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |