A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. (CVE-2026-100890)

CVE-2026-100890 describes a vulnerability in Trusted Domain Project OpenDMARC up to version 1.4.2. The issue lies in the opendmarc_spf_ipv6_explode function within the SPF Parser component (libopendmarc/opendmarc_spf.c). Manipulating the argument 'cp' leads to a null pointer dereference, which can be exploited remotely to cause a denial of service. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity). Exploit code has been published publicly. The vendor was contacted but did not respond, and no patch or official fix is currently documented.

The vulnerability allows remote attackers to cause a denial of service via a null pointer dereference in the SPF Parser component of OpenDMARC. There is no impact on confidentiality or integrity reported. The exploitability is remote with low attack complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is documented, users should monitor for vendor updates and consider mitigating exposure by restricting access to the vulnerable service or employing network-level protections to limit exploit attempts.