Every CVE Search/ Get API key

CVE-2026-94184

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

5.3 MediumFix available

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.20%Up 0.5 points since Sep 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
CVE-2026-94184
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-06
EUVDEUVD-2026-83923 8.1

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
EUVD-2026-83923
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-5pfw-5pv2-2pc6 8.1

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A...

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
GHSA-5pfw-5pv2-2pc6
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 5.3

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
CVE-2026-94184
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-06
OSV 5.3

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
CVE-2026-94184
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-121
Updated
2026-11-07
OSVDEBIAN-CVE-2026-94184 5.3

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
DEBIAN-CVE-2026-94184
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 18 moreShow less
OSVOESA-2026-4206 8.1

fetchmail security update

Fetchmail is a mail retrieval daemon that can download messages from POP3, IMAP, ODMR and ETRN-based stores, with SSL/TLS security including certificate verification, and pass downloaded mail to a local SMTP or LMTP server, or a message delivery agent such as maildrop.

Security Fix(es):

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Affects v5.0.8 through v6.6.6.(CVE-2026-94184)

Record
OESA-2026-4206
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4207 8.1

fetchmail security update

Fetchmail is a mail retrieval daemon that can download messages from POP3, IMAP, ODMR and ETRN-based stores, with SSL/TLS security including certificate verification, and pass downloaded mail to a local SMTP or LMTP server, or a message delivery agent such as maildrop.

Security Fix(es):

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Affects v5.0.8 through v6.6.6.(CVE-2026-94184)

Record
OESA-2026-4207
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4208 8.1

fetchmail security update

Fetchmail is a mail retrieval daemon that can download messages from POP3, IMAP, ODMR and ETRN-based stores, with SSL/TLS security including certificate verification, and pass downloaded mail to a local SMTP or LMTP server, or a message delivery agent such as maildrop.

Security Fix(es):

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Affects v5.0.8 through v6.6.6.(CVE-2026-94184)

Record
OESA-2026-4208
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-4209 8.1

fetchmail security update

Fetchmail is a mail retrieval daemon that can download messages from POP3, IMAP, ODMR and ETRN-based stores, with SSL/TLS security including certificate verification, and pass downloaded mail to a local SMTP or LMTP server, or a message delivery agent such as maildrop.

Security Fix(es):

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Affects v5.0.8 through v6.6.6.(CVE-2026-94184)

Record
OESA-2026-4209
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:85959 5.3

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:85959
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:86981 5.3

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:86981
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2026:86982 5.3

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:86982
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-94184 5.3

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
UBUNTU-CVE-2026-94184
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:85959 No score

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:85959
Updated
2026-11-02
OSVALSA-2026:86981 No score

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86981
Updated
2026-11-02
OSVALSA-2026:86982 No score

Moderate: fetchmail security update

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so the user can read it through their favorite mail client.

Security Fix(es):

  • fetchmail: fetchmail: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) (CVE-2026-94184)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:86982
Updated
2026-11-02
OSVAZL-105066 No score

CVE-2026-94184 affecting package fetchmail 6.4.39-2

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Record
AZL-105066
Updated
2026-11-05
OSVopenSUSE-SU-2026:12115-1 No score

fetchmail-6.6.8-1.1 on GA media

These are all security issues fixed in the fetchmail-6.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12115-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22077-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issue:

  • CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
Record
openSUSE-SU-2026:22077-1
Updated
2026-11-02
OSVSUSE-SU-2026:24221-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issue:

  • CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
Record
SUSE-SU-2026:24221-1
Updated
2026-11-02
OSVSUSE-SU-2026:4567-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issue:

  • CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
Record
SUSE-SU-2026:4567-1
Updated
2026-11-02
OSVSUSE-SU-2026:4604-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issue:

  • CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
Record
SUSE-SU-2026:4604-1
Updated
2026-11-02
OSVSUSE-SU-2026:4605-1 No score

Security update for fetchmail

This update for fetchmail fixes the following issue:

  • CVE-2026-94184: stack-based buffer overflow in NTLM authentication can lead to remote code execution or process termination (bsc#1282055).
Record
SUSE-SU-2026:4605-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
fetchmail
AlmaLinux:10
 before 6.4.38-3.el10_2.1
6.4.38-3.el10_2.1
fetchmail
AlmaLinux:9
 before 6.4.24-1.el9_8.1
6.4.24-1.el9_8.1
fetchmail
AlmaLinux:8
 before 6.4.24-1.el8_10.1
6.4.24-1.el8_10.1
fetchmail
Azure Linux:3
 through 6.4.39-2 None known
fetchmail
Debian:12
 All versions, plus listed versions
6.4.37-16.4.38-16.4.39-16.5.6-16.5.6-2
Show 12 moreShow less
6.5.7-16.6.0-16.6.1-16.6.2-16.6.2-26.6.2-36.6.3-16.6.3-26.6.3-36.6.6-16.6.8-16.6.9-1
 None known
fetchmail
Debian:13
 All versions, plus listed versions
6.4.39-16.5.6-16.5.6-26.5.7-16.6.0-1
Show 10 moreShow less
6.6.1-16.6.2-16.6.2-26.6.2-36.6.3-16.6.3-26.6.3-36.6.6-16.6.8-16.6.9-1
 None known
fetchmail
Debian:14
 before 6.6.8-1, plus listed versions
6.4.39-16.5.6-16.5.6-26.5.7-16.6.0-1
Show 8 moreShow less
6.6.1-16.6.2-16.6.2-26.6.2-36.6.3-16.6.3-26.6.3-36.6.6-1
6.6.8-1
fetchmail
openEuler:24.03-LTS-SP4
 before 6.4.37-3.oe2403sp4
6.4.37-3.oe2403sp4
fetchmail
openEuler:22.03-LTS-SP4
 before 6.4.22-4.oe2203sp4
6.4.22-4.oe2203sp4
fetchmail
openEuler:24.03-LTS-SP1
 before 6.4.37-3.oe2403sp1
6.4.37-3.oe2403sp1
Show 29 moreShow less
Affected packages
PackageAffectedFixed
fetchmail
openEuler:24.03-LTS-SP3
 before 6.4.37-3.oe2403sp3
6.4.37-3.oe2403sp3
fetchmail
Rocky Linux:10
 before 0:6.4.38-3.el10_2.1
0:6.4.38-3.el10_2.1
fetchmail
Rocky Linux:9
 before 0:6.4.24-1.el9_8.1
0:6.4.24-1.el9_8.1
fetchmail
Rocky Linux:8
 before 0:6.4.24-1.el8_10.1
0:6.4.24-1.el8_10.1
fetchmail
SUSE:Linux Enterprise Server 16.0
 before 6.5.2-160000.4.1
6.5.2-160000.4.1
fetchmail
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 6.5.2-160000.4.1
6.5.2-160000.4.1
fetchmail
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 6.3.26-13.24.1
6.3.26-13.24.1
fetchmail
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 6.3.26-13.24.1
6.3.26-13.24.1
fetchmail
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 6.4.22-150600.35.6.1
6.4.22-150600.35.6.1
fetchmail
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 6.4.22-150600.35.6.1
6.4.22-150600.35.6.1
fetchmail
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 6.4.22-150600.35.6.1
6.4.22-150600.35.6.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 6.4.22-150600.35.6.1
6.4.22-150600.35.6.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 6.4.22-150000.20.32.1
6.4.22-150000.20.32.1
fetchmail
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.3.26-16.3.26-2
 None known
fetchmail
Ubuntu:18.04:LTS
 All versions, plus listed versions
6.3.26-36.3.26-3build16.3.26-3ubuntu0.1~18.04.1
 None known
fetchmail
Ubuntu:20.04:LTS
 All versions, plus listed versions
6.4.0~rc4-1ubuntu16.4.1-1ubuntu16.4.2-2
 None known
fetchmail
Ubuntu:22.04:LTS
 All versions, plus listed versions
6.4.22-16.4.23-16.4.24-16.4.25-16.4.26-16.4.27-16.4.27-1ubuntu0.1
 None known
fetchmail
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.4.37-16.4.38-1ubuntu16.4.38-1ubuntu36.4.38-1ubuntu46.4.38-1ubuntu4.1
 None known
fetchmail
Ubuntu:26.10
 All versions, plus listed versions
6.6.2-26.6.3-36.6.6-16.6.6-1build1
 None known
fetchmail
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.5.4-0ubuntu26.5.4-0ubuntu36.6.2-2
 None known
fetchmail
openSUSE:Tumbleweed
 before 6.6.8-1.1
6.6.8-1.1
fetchmail
openSUSE:Leap 16.0
 before 6.5.2-160000.4.1
6.5.2-160000.4.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-94184 is a medium vulnerability (CVSS 5.3) in Red Hat Enterprise Linux 10, published September 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in fetchmail 6.4.38-3.el10_2.1.

References

Show 28 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open