VMime fixes attachment decoder overflow and data leak

What was disclosed

The CVE records for CVE-2026-116738 and CVE-2026-116739, published on 26 October 2026, describe two flaws in VMime through version 0.9.2. They affect applications that use the C++ email library to decode specially crafted uuencoded MIME parts.

The first flaw can overwrite stack memory, crashing the application or potentially allowing code execution. The second can copy uninitialized stack contents into decoded attachments, exposing up to 15 bytes per malformed line. The impact depends on how the application processes and exposes the decoded content.

The patch predates the CVE records

VMime’s maintainers merged the decoder fixes on 23 October. The patch also hardens stream bounds checks and corrects other decoding errors. Its commit is e85925e.

The project’s release page still lists 0.9.2 as the latest numbered release. A current version label alone therefore does not establish that a deployed build contains the fix.

What administrators should check

Inventory mail applications and services that include VMime, including bundled copies. Ask the application vendor or distribution maintainer whether the installed build includes this patch or an equivalent backport, and use its supported update route.

Teams building from source should incorporate the upstream fix and test MIME decoding before deployment. These are library implementation flaws; changing SPF, DKIM or DMARC records does not repair an affected decoder.