CVE-2026-100890

Name of the Vulnerable Software and Affected Versions OpenDMARC versions prior to 1.4.3

Description A flaw in the SPF Parser component exists within the opendmarc spf ipv6 explode() function located in the libopendmarc/opendmarc spf.c library. A remote attacker can trigger a null pointer dereference, which occurs when a program attempts to read from a memory address that is null, by manipulating the cp argument.

Recommendations Update to a version newer than 1.4.2. As a temporary mitigation, restrict the processing of SPF records that may trigger the opendmarc spf ipv6 explode() function.