Threats affecting pkg:deb/trusted_domain_project/opendkim

CVE-2026-100888 is an out-of-bounds write vulnerability in the Trusted Domain Project OpenDKIM software, specifically in the dkim_canon_selecthdrs function of the DKIM Signature Header Selection component. This flaw affects OpenDKIM versions 2.0 through 2.11.0. The vulnerability can be exploited remotely without authentication by manipulating a function argument, potentially leading to memory corruption. Public exploit code is available, but no vendor response or patch has been provided as of the publication date.

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0. Affected is the function dkim_qp_decode of the file util.c of the component Decoder. The manipulation results in off-by-one. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.