Quick answers
- Is CVE-2026-101014 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101014 being exploited in the wild.
- How severe is CVE-2026-101014?
- High severity, with a CVSS score of 7.3, published 28 September 2026.
- Which products and versions are affected?
- Trusted Domain Project OpenDMARC up to 1.4.2.
- Is there a fix for CVE-2026-101014?
- A patch was published on 2021-09-16: Patch commit b3b1da9 merged to fix off-by-one comparison Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101014 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-101014?
- Check whether you run Trusted Domain Project OpenDMARC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an off-by-one error in the opendmarc_util_cleanup function in libopendmarc/opendmarc_util.c, where the buffer boundary check uses > instead of >=, allowing a string exactly equal to buflen to bypass validation and write past the buffer. This is a classic heap or stack buffer overflow with remote network attack vector if the library processes untrusted DMARC record data. A patch fixing the comparison operator from > to >= was merged in commit b3b1da9.
Affected products
- Trusted Domain Project OpenDMARC up to 1.4.2
Timeline
- 2026-09-28: disclosed: CVE-2026-101014 published
- 2021-09-16: patched: Patch commit b3b1da9 merged to fix off-by-one comparison