CVE-2026-116739

17th percentile - higher than 17% of all known CVEs

VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.

Sensitive data from process memory may leak, posing a risk of confidential information disclosure. Organizations processing MIME attachments with VMime are exposed to data theft.

Update VMime to a version newer than 0.9.2 if available, or apply the vendor patch. Until then, consider restricting processing of untrusted uuencode attachments.