CVE-2026-100888 in OpenDKIM
Summary
by MITRE • 09/28/2026
A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/28/2026
The Trusted Domain Project OpenDKIM, a widely deployed implementation of the DomainKeys Identified Mail (DKIM) standard, contains a critical memory corruption vulnerability within its DKIM signature header selection logic. Specifically, the flaw resides in the dkim_canon_selecthdrs function located in the libopendkim/dkim-canon.c source file. This component is responsible for parsing and selecting headers from an email message to be included in the cryptographic signature. The vulnerability arises when the h argument, which specifies the list of headers to sign, contains manipulated or malformed input that exceeds expected bounds during processing.
This flaw results in a heap-based out-of-bounds write condition. When the function processes header names provided by an attacker-controlled email message, it fails to adequately validate the length and structure of these inputs before writing them into internal buffers. Consequently, data is written beyond the allocated memory boundaries associated with the buffer intended for storing selected headers. This type of vulnerability falls under CWE-787: Out-of-bounds Write in standard classification systems, representing a severe integrity violation that compromises the stability and security of the application process running OpenDKIM.
The operational impact of this vulnerability is significant because it can be exploited remotely without authentication. An attacker who controls an email server or intercepts network traffic can craft maliciously formatted DKIM signing requests or manipulate incoming mail processing pipelines to trigger the buffer overflow. Since OpenDKIM often runs with elevated privileges to perform cryptographic operations and modify message headers, successful exploitation may allow for arbitrary code execution on the affected system. This could lead to a complete compromise of the mail server, enabling further lateral movement within the network, data exfiltration, or disruption of email services through denial-of-service conditions caused by application crashes.
The severity is compounded by the fact that proof-of-concept exploits have been publicly released and are actively available for use in attacks. This widespread availability lowers the barrier to entry for threat actors who may not possess advanced exploitation skills but can leverage existing tools to target vulnerable mail infrastructure. Furthermore, the vendor's lack of response to early disclosure attempts has delayed the dissemination of patches or official guidance, leaving many organizations exposed during a critical window where awareness and mitigation strategies are most needed.
Mitigation efforts should prioritize immediate isolation of affected systems from untrusted networks if possible. Administrators must upgrade OpenDKIM to version 2.11.1 or later, which contains fixes for this out-of-bounds write issue. In environments where upgrading is not immediately feasible, implementing strict input validation at the network perimeter using intrusion detection and prevention systems can help block malformed DKIM headers before they reach the vulnerable component. Additionally, deploying email security gateways that perform deep packet inspection on SMTP traffic can provide an additional layer of defense against exploitation attempts targeting this specific memory corruption flaw.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to initial access and privilege escalation via exploited applications. Attackers may use this vector as part of a broader campaign involving phishing or supply chain attacks where malicious emails are processed by vulnerable mail servers. Continuous monitoring for anomalous behavior in DKIM processing logs and memory usage patterns can aid in detecting active exploitation attempts. Organizations should also review their incident response plans to include scenarios specific to remote code execution via email infrastructure components, ensuring rapid containment procedures are ready if a breach occurs through this vector.