Is CVE-2026-116265 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116265 being exploited in the wild.

How severe is CVE-2026-116265?

Informational severity, published 28 October 2026.

Is there a fix for CVE-2026-116265?

Yes: fixed in MIME-tools 5.521. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116265 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116265?

Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116265: MIME::tools RFC 2231 boundary ambiguity check bypass

CVE-2026-116265 · Severity: info · Published 2026-10-28

MIME::tools is a Perl library used by mail systems to parse email messages. A vulnerability allows attackers to craft emails where the multipart boundary is encoded in a way that bypasses security checks, potentially hiding attachments from email filters while the recipient sees them normally. This could allow malicious attachments to evade antivirus or content filtering systems.

Technologies: Perl MIME-tools. Vendors: Perl.

Quick answers

Is CVE-2026-116265 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116265 being exploited in the wild.
How severe is CVE-2026-116265?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Perl MIME-tools before 5.521.
Is there a fix for CVE-2026-116265?: Yes: fixed in MIME-tools 5.521. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116265 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116265?: Check whether you run Perl MIME-tools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: MIME-tools 5.521

Technical details

The boundary ambiguity validation in MIME::Field::ParamVal only checks plain "boundary=" parameters but misses boundaries split using RFC 2231 continuations (boundary*0=, boundary*1=, etc.) that are reassembled after checks run. Additionally, encoded words or trailing whitespace in RFC 2231-encoded boundaries go unflagged, though multipart_boundary() later decodes or strips them. A remote attacker can exploit this to make MIME::Parser interpret a different boundary than other mail clients, allowing attachments to bypass filters using ambiguous_content().

Affected products

Perl MIME-tools before 5.521

Timeline

2026-10-28: disclosed
2026-10-27: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.