Description

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-21T15:17:38.547Z",
  "pubdate": "2026-09-21T15:17:38.547Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in fetchmail when compiled with NTLM authentication support. The flaw resides in the handling of NTLM Type 2 challenge messages during the authentication handshake process. By providing a specifically crafted challenge, a malicious mail server can induce a memory corruption event, resulting in an out-of-bounds write to the stack.\nThe vulnerability allows for potential remote code execution on the client system, assuming the attacker successfully bypasses local memory protections such as Stack Canaries, Address Space Layout Randomization (ASLR), or Data Execution Prevention (DEP). Should exploitation prove unsuccessful against these hardening mechanisms, the memory corruption will likely trigger a process crash, leading to a denial-of-service condition for the mail retrieval service.\nThis vulnerability is particularly dangerous as it targets the interaction between the client and a potentially compromised or malicious mail server. Exploitation requires the fetchmail process to initiate a connection to the attacker-controlled server and proceed with the NTLM authentication phase. There are no specific user-privilege requirements for exploitation, as the process typically runs with the privileges of the user executing the mail retrieval task.",
  "technicalDetails": "The root cause of this vulnerability is an improper bounds check within the fetchmail NTLM authentication module. When fetchmail is configured to perform NTLM authentication, it exchanges a series of messages with the mail server. The vulnerability is triggered during the processing of the NTLM Type 2 challenge message.\nDuring the construction of the corresponding NTLM authenticate response, the application attempts to copy data derived from the server-provided Type 2 challenge into a fixed-size buffer allocated on the stack. The internal logic fails to validate the size of the incoming challenge fields against the destination buffer's capacity. Consequently, if the server supplies a challenge exceeding the anticipated buffer dimensions, an overflow occurs, overwriting adjacent memory locations on the stack frame.\nThe exploitation flow begins with a client initiating a connection to a malicious mail server via a protocol supported by fetchmail. Upon requesting authentication, the server advertises NTLM support. The client proceeds to request authentication, and the server responds with a malformed NTLM Type 2 challenge. As fetchmail processes this challenge, it invokes the vulnerable function responsible for generating the authentication response. The uncontrolled copy operation forces arbitrary data past the bounds of the local buffer. By carefully crafting the overflow payload, an attacker can overwrite the saved return address or other critical control flow data on the stack. Upon function return, execution is redirected to attacker-supplied instructions or existing gadgets in a Return-Oriented Programming (ROP) chain, facilitating arbitrary code execution in the context of the user running the fetchmail process.\nThe impact of this vulnerability is dependent on the target's environment and memory hardening policies. In systems without modern exploit mitigations, full code execution is achievable. In hardened environments, the corruption of stack metadata will reliably induce a segmentation fault, effectively terminating the fetchmail process and preventing email synchronization. Because fetchmail is often utilized in automated or scheduled environments, this interruption may be persistent if the service is auto-restarted and forced to re-connect to the same malicious server."
}