Off-by-One Memory Error in DMARC Record Parser

CVE-2026-101014 is a high-severity off-by-one vulnerability in OpenDMARC's email authentication parser, specifically within the opendmarc_util_cleanup function. This memory safety flaw affects versions up to 1.4.2 and allows remote attackers to manipulate DMARC record processing, potentially leading to memory corruption, information disclosure, or denial of service. Organizations deploying OpenDMARC for DMARC policy validation—a critical email security control—face exposure to unauthenticated attacks since DMARC processing occurs during normal mail receipt. This vulnerability is particularly concerning because DMARC infrastructure is foundational to email authentication pipelines used across government, finance, and enterprise sectors.

While this specific vulnerability does not directly map to MITRE ATT&CK techniques in the CVE record, Casky's skills would help practitioners detect exploitation attempts by identifying anomalous patterns in email authentication failures, unexpected memory faults in mail processing logs, and suspicious DMARC record formats that could trigger the parser's off-by-one condition. Practitioners using Casky would examine Defense Evasion (T1566 - Phishing) and Initial Access attack chains, as successful exploitation could lead to authentication bypass or mail delivery manipulation. Extended reasoning capabilities would correlate unexpected system crashes or memory errors in opendmarc processes with malformed email headers or DMARC records, enabling earlier detection of active exploitation attempts before widespread impact occurs. Immediate patching to commit b3b1da9264bc80324094a27c71e7369bdedc62ae is critical.