This vulnerability affects the Trusted Domain Project OpenDKIM software versions 2.0 through 2.11.0. The issue lies in the dkim_process_set function of the dkim.c file in the Tag Tokenizer component, where manipulation can lead to the use of a less trusted source. This can undermine the integrity of DKIM signature verification processes. The vulnerability is remotely exploitable without privileges or user interaction. Although the vendor was notified, no fix or advisory has been issued. Public exploit code has been released, increasing the risk of exploitation.

An attacker can remotely exploit this vulnerability to cause OpenDKIM to rely on a less trusted source during DKIM processing. This may weaken the validation of email signatures, potentially allowing forged or malicious emails to be accepted as legitimate. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, no privileges required, no user interaction, and limited impact on confidentiality and availability.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation guidance is provided, users should monitor for updates from the Trusted Domain Project. Until a patch is released, consider implementing additional email validation controls or filtering to mitigate potential risks from forged DKIM signatures.