CVE-2026-116739
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Oct 26, 2026
CISA due date
—
The record
VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memory into decoded output for over-long lines. Attackers can send a crafted uuencode or x-uuencode MIME part with a large line length byte to leak up to 15 bytes of stack contents per line in decoded attachments.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119602 libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in… CWE-908
- CVE-2026-119375 SQLite before 3.54.0 contains an information disclosure vulnerability that allows… CWE-908
- CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. CWE-908
- CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains an… CWE-908
- CVE-2026-114651 A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver… CWE-908
- CVE-2026-114501 Pillow is a Python imaging library. CWE-908
- CVE-2026-112897 Pillow is a Python imaging library. CWE-908
- CVE-2026-96206 Use of uninitialized resource in Windows Subsystem for Linux allows an authorized… CWE-908