Is CVE-2026-116738 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116738?

CVE-2026-116738 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-116738

Description

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.