VULNERABILITY INTELLIGENCE
CVE-2026-116739
CVSS score5.3 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-10-26
Last modified2026-10-27
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Weakness classification
- CWE-908: Use of Uninitialized Resource