An off-by-one error exists in the dkim_qp_decode function within the util.c component of Trusted Domain Project OpenDKIM versions up to 2.11.0. This vulnerability can be triggered remotely and may result in memory corruption or similar unintended behavior. The vulnerability is publicly disclosed with exploit code available, but the vendor has not issued any response or fix.

The off-by-one vulnerability can be exploited remotely without authentication, potentially leading to partial memory corruption or other unintended side effects. The CVSS 4.0 vector indicates low complexity and no privileges or user interaction required, with partial impact on confidentiality, integrity, and availability. However, no confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official Trusted Domain Project communications for updates. Until a patch is available, consider mitigating exposure by restricting access to OpenDKIM services and applying general best practices for limiting remote attack surfaces.