VULNERABILITY INTELLIGENCE
CVE-2026-82520
CVSS score7.5 HIGH
EPSS probability0.78%
CISA KEVNot currently listed
Published2026-09-03
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed output size. Because parsedmarc automatically processes incoming DMARC report emails without user interaction, an unauthenticated remote attacker can send a crafted email with a highly compressed attachment to the monitored mailbox, causing the parsedmarc process to allocate memory proportional to the uncompressed size and exhaust available RAM.
Weakness classification
- disclosure@vulncheck.com: CWE-409