This vulnerability affects the OpenDMARC library versions 1.4.0, 1.4.1, and 1.4.2. The issue is an encoding error in the function opendmarc_policy_query_dmarc within the Internationalized Domain Name Handler component (libopendmarc/opendmarc_policy.c). The flaw allows remote attackers to manipulate encoding, potentially impacting the processing of DMARC policies. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, low complexity, no privileges required, no user interaction, and limited impact on confidentiality, integrity, and availability. The exploit code has been publicly disclosed, but no active exploitation is reported. The vendor was contacted but did not provide any response or patch.

The vulnerability allows remote attackers to cause an encoding error in the OpenDMARC library's handling of Internationalized Domain Names. This could lead to incorrect DMARC policy processing, potentially affecting email authentication and filtering decisions. The impact is rated medium with limited confidentiality, integrity, and availability consequences. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should monitor official Trusted Domain Project channels for updates. Until a fix is available, consider mitigating risk by restricting access to affected OpenDMARC services or applying additional email filtering controls where feasible.