CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to remote code execution in NTLM authentication client (revised fetchmail-SA-2026-01)

fetchmail, when compiled with NTLM support, contains a stack-based buffer overflow (CWE-121) in the code that constructs the NTLM authenticate response while parsing a server-supplied Type 2 challenge. A malicious or compromised POP3/IMAP mail server that advertises NTLM authentication can trigger the overflow during the authentication handshake, writing past a fixed stack buffer before any mail is transferred. Depending on stack-frame layout, this can yield remote code execution in the fetchmail process; on memory-hardened builds it more likely causes authentication failure or a crash (denial of polling). The CVSS 3.1 score is 8.1 (high) with network vector and no privileges or user interaction required, though attack complexity is high because the attacker must control or have compromised the mail server that fetchmail polls. There is no public proof of concept, the flaw is not in the CISA KEV catalog, and no exploitation has been observed in the wild.