CVE-2026-94184 is a stack-based buffer overflow flaw in fetchmail when compiled with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a specially crafted Type 2 challenge that causes fetchmail to write beyond a fixed stack buffer while constructing the NTLM authenticate response. This buffer overflow may result in remote code execution depending on the stack-frame layout or cause authentication failure or process termination if memory hardening is enabled. The vulnerability affects Red Hat Enterprise Linux 10. The issue is tracked under Bugzilla 2537395 and identified as CWE-121. Red Hat recommends either rebuilding fetchmail without NTLM support or upgrading to fetchmail 6.6.7 or later to mitigate the issue.

Successful exploitation can lead to remote code execution, authentication failure, or process termination due to a stack-based buffer overflow in fetchmail's NTLM authentication handling. The impact includes high confidentiality, integrity, and availability risks as indicated by the CVSS score of 8.1. However, reliable remote code execution depends on the specific stack-frame layout, and in some cases, the overflow may cause the process to abort instead of executing arbitrary code.

Red Hat advises rebuilding fetchmail without NTLM support by omitting the --enable-NTLM option at configure time or upgrading to fetchmail version 6.6.7 or later. Confirm the absence of NTLM support with the command 'fetchmail -V' to ensure the build does not list +NTLM. These are the primary mitigations; no other vendor-provided mitigations are indicated.