CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to remote code execution in NTLM authentication client (revised fetchmail-SA-2026-01)
Some fetchmail 6.6.6 and older builds may allow RCE via an NTLM stack overflow.
Matthias Andree revised fetchmail-SA-2026-01, tracked as CVE-2026-94184. Some builds of fetchmail 6.6.6 and older compiled with NTLM support can suffer a stack buffer overflow in the NTLM authentication client. A rogue server could potentially gain remote code execution, depending on the compiler, ABI, calling conventions, and build flags. The advisory was first announced on 2026-06-27 and revised on 2026-09-22 as version 1.2.
- CVE-2026-94184 affects some fetchmail 6.6.6 and older builds.
- A stack buffer overflow is in the NTLM authentication client.
- Code execution depends on --enable-NTLM, compiler, ABI, and flags.
- fetchmail-SA-2026-01 was revised to version 1.2 on 2026-09-22.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94184 | Stack Buffer Overflow in fetchmail NTLM Handling Enables Remote Code Execution | 5.3 | — |
From the original article
Posted by Matthias Andree on Sep 22 fetchmail-SA-2026-01: --enable-NTLM potential remote code execution Topics: Possible remote code execution from a rogue server through stack buffer overflow in NTLM authentication method, depending on build details including compiler, ABI, call conventions, and compiler flags. Author: Matthias Andree Version: 1. 2 Announced: 2026-06-27, revised 2026-09-22 Type:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.