A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. (CVE-2026-100891)

The Trusted Domain Project OpenDMARC software up to version 1.4.2 contains a vulnerability in the opendmarc_policy_query_dmarc function located in libopendmarc/opendmarc_policy.c, specifically in the Internationalized Domain Name Handler component. This vulnerability results in an encoding error that can be triggered remotely. The issue has been publicly disclosed, and the vendor was contacted but did not provide a response or patch. The CVSS 3.1 base score is 7.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to an encoding error affecting the confidentiality, integrity, and availability of the affected system. The attack can be launched remotely without requiring privileges or user interaction. Although exploit code has been disclosed publicly, there are no reports of active exploitation in the wild. The lack of vendor response means no official fix or mitigation has been confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the affected service or applying network-level controls to limit exposure to untrusted sources.