| Title | The Trusted Domain Project OpenDMARC 1.4.2 Integer Overflow |
|---|
| Description | OpenDMARC 1.4.2 contains an integer wraparound vulnerability when parsing the DMARC `pct` tag. The value is converted to a 32-bit unsigned integer before OpenDMARC verifies that it falls within the RFC-defined range of 0 to 100. Consequently, an out-of-range value is reduced modulo 2³² before validation.
For example, `pct=4294967296` wraps to `0`, while `pct=4294967346` wraps to `50`. OpenDMARC accepts these records and applies the resulting wrapped value as the policy sampling percentage, even though the published values are invalid under RFC 7489. The enforced DMARC policy can therefore differ from the policy actually published by the domain owner.
An attacker able to influence a domain’s DMARC record can exploit the issue by supplying a specially chosen `pct` value. The same behavior may also be triggered by an administrative configuration error. Depending on the wrapped result, OpenDMARC may enforce the policy at an unintended sampling rate or treat the record as invalid and fail to apply a published `p=reject` or `p=quarantine` policy.
The issue is caused by integer overflow during conversion and should be addressed by detecting overflow and validating the original numeric value before storing it in a 32-bit type. |
|---|
| Source | ⚠️ https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html |
|---|
| User | yongzhe_xu (UID 100420) |
|---|
| Submission | 08/07/2026 06:09 (2 months ago) |
|---|
| Moderation | 09/28/2026 13:53 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 411036 [Trusted Domain Project OpenDMARC up to 1.4.2 DMARC Parser opendmarc_policy.c pct integer overflow] |
|---|
| Points | 20 |
|---|