CVE-2026-100891 Trusted Domain Project CVE debrief

Who should care

Defenders of systems using OpenDMARC should assess exposure and prioritize verification of system configurations and monitor for potential attacks due to remote exploitability of the encoding error vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams.

Why it matters

Defenders should assess exposure of OpenDMARC installations, prioritize verification of system configurations, and monitor for potential attacks due to the remote exploitability of the encoding error vulnerability.

• Verify OpenDMARC version and configurations
• Monitor for potential encoding errors
• Assess remote attack feasibility

Technical summary

The opendmarc_policy_query_dmarc function in OpenDMARC's libopendmarc/opendmarc_policy.c has an encoding error. This issue affects OpenDMARC up to version 1.4.2 and can be exploited remotely. The vulnerability is in the Internationalized Domain Name Handler component. Defenders should assess exposure, prioritize verification, and monitor for potential attacks due to remote exploitability of the encoding error vulnerability. The CVE record was published on 2026-09-28T01:16:28.367Z and has not been modified since then.

Defensive priority

Defenders should assess exposure, prioritize verification, and monitor for potential attacks

Recommended defensive actions

• Assess exposure of OpenDMARC installations
• Verify system configurations and update to a fixed version if available
• Monitor for potential attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE and NVD records provide details on the vulnerability and its CVSS score of 5.5. Additional information comes from Vuldb references. The vulnerability affects OpenDMARC's Internationalized Domain Name Handler, specifically the opendmarc_policy_query_dmarc function in libopendmarc/opendmarc_policy.c. The issue is an encoding error that allows for remote attacks. Exploit details have been made public.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.