Global Buffer Overflow in KMime Package - Vulnerability OSV-2026-200
Summary
OSV-2026-200: Global-buffer-overflow in nameMatch. Affects kmime versions >= e5ce14a01c4bc9b612ec8861382874bfca1f9706, < 61d9d5dbf5013ad8b1968611fdd0a89676920444. Fixed in 61d9d5dbf5013ad8b1968611fdd0a89676920444. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
KMime is a library used for parsing and handling MIME (Multipurpose Internet Mail Extensions) messages in applications. It is widely utilized in email clients and other software that requires the processing of email content. The library provides essential functionalities such as encoding and decoding MIME types, which are crucial for proper email formatting and display. However, KMime has recently been identified to have a global buffer overflow vulnerability that could potentially lead to severe security issues.
Vulnerability Detail
The vulnerability, identified as OSV-2026-200, is a global buffer overflow that occurs in the 'nameMatch' function of the KMime library. This issue arises from improper handling of input data, which can lead to a crash or exploitation by attackers. The specific crash type is a global buffer overflow during a read operation, which can compromise the integrity of the application using the KMime library. The vulnerability was reported through OSS-Fuzz, indicating its potential severity and the need for immediate attention.
How To Fix
Minimum fixed version
61d9d5dbf5013ad8b1968611fdd0a89676920444
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that the data being processed by the KMime library does not exceed expected limits. This can help mitigate the risk of exploitation until the package is updated. However, this is not a permanent solution and should be followed by an update to the patched version.
Conclusion
The KMime package has a critical global buffer overflow vulnerability that needs immediate attention. Users are advised to update to the patched version to mitigate risks. Additionally, utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for kmime →
FAQ
A global buffer overflow is a type of vulnerability where a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory. This can lead to crashes or allow attackers to execute arbitrary code.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check if your application is affected by this vulnerability.
Failing to address this vulnerability can lead to application crashes, data corruption, or exploitation by attackers, which may compromise sensitive information or allow unauthorized access.
Yes, the patched version of KMime that resolves this vulnerability is 61d9d5dbf5013ad8b1968611fdd0a89676920444. It is recommended to update to this version as soon as possible.
Yes, you can use the Vulert playground to check for vulnerabilities in your application without requiring any signup. Simply visit Vulert Scanner and upload your manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for kmime.
