Description

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-28T09:17:05.503Z",
  "pubdate": "2026-09-28T09:17:05.503Z",
  "executiveSummary": "A vulnerability has been identified in Trusted Domain Project OpenDMARC versions up to 1.4.2, specifically within the strcasecmp function located in libopendmarc/opendmarc_policy.c.\nThis flaw involves the improper handling of exceptional conditions during string comparison operations. The vulnerability is exploitable remotely, allowing an unauthenticated attacker to trigger the condition without prior system access.\nThe primary risk implication involves potential service instability or denial-of-service (DoS) conditions, as the failure to gracefully handle specific inputs during the DMARC policy evaluation process can lead to abnormal program termination.\nPublicly available exploit code increases the risk of successful exploitation. As the vendor has remained unresponsive to disclosure, no official security patches are currently provided to address this specific defect.\nOrganizations relying on OpenDMARC for email authentication should evaluate their exposure and implement compensatory controls to mitigate the impact of remote exploitation targeting these specific code paths.",
  "technicalDetails": "The vulnerability resides in the libopendmarc/opendmarc_policy.c component of the OpenDMARC library, specifically within the implementation of the strcasecmp function. The root cause is an improper handling of exceptional conditions during the execution of string comparison routines used to validate DMARC policy parameters.\nIn the context of OpenDMARC, the strcasecmp function is employed to compare DMARC-related strings (such as domain names or policy tags) in a case-insensitive manner. The vulnerability is triggered when the application receives crafted inputs that cause the comparison function to enter an undefined or error state due to unexpected data types, null pointers, or memory boundary conditions that the library fails to anticipate.\nThe attack flow begins with an attacker sending a maliciously crafted email or policy-related request containing specific strings designed to exploit the logic error within strcasecmp. Because OpenDMARC functions as an MTA filter, the application processes these strings while performing policy lookups or parsing DNS responses. When the input reaches the vulnerable function, the failure to correctly manage the exceptional state can lead to a crash of the filter process, effectively bypassing DMARC protections or causing a denial-of-service for the mail processing pipeline.\nSince the vulnerability is remotely exploitable, an attacker does not require local authentication or elevated privileges. The network exposure is determined by the accessibility of the mail transfer agent (MTA) integrated with OpenDMARC. The payload behavior is focused on disrupting the availability of the email filtering service by inducing a failure in the policy assessment engine. The post-exploitation impact is primarily service disruption, though the potential for secondary effects depends on the specific architecture of the deployment and how the MTA handles the crash of the OpenDMARC filter plugin (e.g., whether it fails open or fails closed).\nAffected versions include all OpenDMARC releases up to and including 1.4.2. As the vulnerability involves the underlying logic of policy string evaluation, the impact is consistent across different host operating systems, provided the vulnerable version of the library is linked to the active mail filtering infrastructure."
}