CVE-2026-116738

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line, corrupting stack memory to crash the application or potentially execute code.

A remote attacker can crash the email-processing application or potentially execute arbitrary code in its context. The risk affects systems that process untrusted emails with MIME attachments.

Upgrade VMime to a version newer than 0.9.2 if available, or apply mitigations for processing untrusted messages. Consider filtering suspicious uuencoded MIME parts at the mail gateway.