Information Disclosure Vulnerability in VMime by Kisli

CVE-2026-116739

What is CVE-2026-116739?

The VMime library, up to version 0.9.2, contains an information disclosure vulnerability within its uuEncoder::decode function. This weakness allows attackers to exploit crafted uuencode or x-uuencode MIME parts by sending unusually long lines, resulting in the leakage of uninitialized stack memory. The potential exposure includes up to 15 bytes of stack content for each line processed in decoded attachments, raising significant security concerns for applications utilizing this library. Users are advised to upgrade to patched versions to mitigate this vulnerability.

References