Description

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-28T09:17:05.180Z",
  "pubdate": "2026-09-28T09:17:05.180Z",
  "executiveSummary": "A critical vulnerability exists in the Domain Handler component of the Trusted Domain Project OpenDMARC, affecting all versions up to and including 1.4.2.\nThe vulnerability involves improper validation of unsafe equivalence within the file policy.c, which facilitates potential security compromises.\nThis flaw is remotely exploitable, allowing unauthenticated attackers to manipulate input and bypass intended security policies.\nThe publication of functional exploit code increases the risk to production environments, as the vulnerability can be leveraged without prior knowledge of internal system configurations.\nGiven that the vendor has remained unresponsive to disclosure attempts, no official patch is currently available to address this specific logic error.\nOrganizations relying on OpenDMARC for email authentication should consider the impact on DMARC policy enforcement, as successful exploitation could lead to the bypass of domain authentication mechanisms, potentially enabling spoofing or unauthorized mail flow handling.",
  "technicalDetails": "The vulnerability is situated within the policy.c source file, which is a core component of the OpenDMARC Domain Handler. The flaw stems from an improper validation mechanism regarding input equivalence. Specifically, the software fails to correctly sanitize or verify input before processing it against defined domain policies.\nIn the context of the Domain Handler, this implies that an attacker can submit crafted input that the system incorrectly identifies as equivalent to a trusted or authorized entity. This failure in logical equivalence checking suggests a flaw in how string comparisons or domain name normalizations are performed within the C-based logic of policy.c.\nThe attack flow begins when an attacker transmits a maliciously crafted packet to the OpenDMARC service. Since this is a remote vulnerability, no local system access or pre-existing user privileges are required for initiation. The attacker crafts an input string that triggers the flawed validation logic, effectively deceiving the Domain Handler into applying incorrect policy rules.\nStep-by-step exploitation involves: 1. Identifying the specific input vectors accepted by the OpenDMARC policy engine; 2. Crafting a malformed domain identifier or policy-related string designed to bypass internal equivalence checks; 3. Delivering this payload to the vulnerable endpoint; 4. Exploiting the engine's subsequent reliance on the incorrectly validated input to force an erroneous DMARC policy decision (e.g., classifying an unauthorized domain as authorized).\nBecause the logic in policy.c is responsible for enforcing authentication protocols, the post-exploitation impact allows for the circumvention of email security controls. An attacker could potentially cause the system to accept forged email messages by tricking the Domain Handler into providing an 'authorized' or 'pass' status for inputs that should have failed verification. The absence of vendor response means the internal code structure likely remains exposed to this logic error, necessitating manual intervention by administrators to protect the mail processing pipeline."
}