VMime: Stack-based buffer overflow in uuEncoder::decode (CVE-2026-116738)

VMime library versions through 0.9.2 are susceptible to an integer underflow within the uuEncoder::decode function. This flaw is triggered when an application processes a crafted uuencoded MIME part where a line begins with the length character 'b' but does not constitute a valid 'begin' line. This input corruption leads to a stack-based buffer overflow, which can result in application denial of service or potential remote code execution.

Impact

Successful exploitation allows remote attackers to corrupt stack memory. The primary observed impact is application instability, with a theoretical potential for arbitrary code execution depending on the host application implementation.

Recommendation

• Inventory systems and applications that utilize the VMime library (up to 0.9.2).
• Prioritize upgrading the VMime library to a patched version once released by the maintainers.
• Implement email filtering or MIME-parsing pre-processors to inspect and discard malformed uuencoded MIME parts that match the length character 'b' logic identified as malicious.