Off-by-One Vulnerability in Trusted Domain Project OpenDKIM by Trusted Domain Project
CVE-2026-100889

6.9MEDIUM

Key Information:

Vendor: Trusted Domain Project
Status: Opendkim
Vendor: CVE Published:; 27 September 2026

🔔 Create Trusted Domain Project Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-100889?

A vulnerability has been identified in the Trusted Domain Project OpenDKIM, specifically within the dkim_qp_decode function in the util.c file. This flaw can lead to an off-by-one error, which poses a risk of exploitation by remote attackers. The exploit details have been made public, indicating that this may lead to unauthorized actions if not addressed promptly. Despite early notifications to the vendor regarding this security issue, no response has been received.

Affected Version(s)

OpenDKIM 2.0

OpenDKIM 2.1

OpenDKIM 2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-100889 - Proof of Concept