VMime: Stack-based buffer overflow in uuencode decoder
Summary
VMime, a C++ library for parsing and building email and MIME messages, contains an integer underflow in the uuEncoder::decode function. A remote attacker can send an email with a crafted uuencoded MIME part to trigger a stack-based buffer overflow. The attack needs no login but requires user interaction (CVSS 4.0 UI:P). The overflow can crash the application and may potentially allow code execution.
Affected
- VMime versions 0.9.2 and earlier (range 0 to <= 0.9.2 per the VulnCheck CVE record)
- Applications that embed libvmime and process inbound MIME mail; the embedding products are unknown
Fixed in
Unknown. No fixed version has been confirmed by the vendor. The referenced commit e85925ed has not been confirmed to fix this CVE.
Workaround
- No vendor-confirmed workaround.
- Where mail is processed by a VMime-based component, consider filtering or quarantining inbound messages with uuencoded or x-uuencoded MIME parts.
Exploitation
- Not known to be exploited in the wild; not in the CISA KEV catalog.
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof of concept found. A third-party write-up exists but has not been reviewed.
Our recommendation
- Check whether libvmime is present in your software, appliances or SBOMs, and identify the version.
- If a vulnerable version (0.9.2 or earlier) is present, ask the vendor or upstream for a fixed release and monitor the upstream repository, pull request #363 and NVD for updates.
- Apply the mitigation filtering described above where mail is processed by a VMime-based component.
- Review the third-party write-up before relying on it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- VMime GitHub repository github.com
- uuEncoder.cpp at v0.9.2 github.com
- Referenced commit e85925ed (fix not confirmed) github.com
- VMime pull request 363 github.com
- VulDB CVE-2026-116738 vuldb.com
- OpenCVE CVE-2026-116738 app.opencve.io
- Strix CVE-2026-116738 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:05.
Original description (NVD)
VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.
NVD references (6)
- https://github.com/kisli/vmime
- https://github.com/kisli/vmime/blob/v0.9.2/src/vmime/utility/encoder/uuEncoder.cpp#L185-L190
- https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
- https://github.com/kisli/vmime/pull/363
- https://hackmd.io/@haindpwn/vmime-uuencode-decoder-oob-write
- https://www.vulncheck.com/advisories/vmime-through-0.9.2-stack-based-buffer-overflow-via-uuencode-decoder
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.