Moderate Security Vulnerability in Fetchmail: Stack-Based Buffer Overflow in NTLM Authentication
Summary
ALSA-2026:86982: Moderate: fetchmail security update. Affects fetchmail versions < 6.4.24-1.el8_10.1. Fixed in 6.4.24-1.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fetchmail is a remote mail retrieval and forwarding utility designed for use over on-demand TCP/IP links, such as SLIP or PPP connections. It supports various remote-mail protocols, including POP2, POP3, IMAP, and ESMTP, allowing users to retrieve and forward emails seamlessly. This utility is widely used for its versatility and compatibility with numerous mail clients. However, it has been identified to have a security vulnerability that could potentially compromise user data.
Vulnerability Detail
The vulnerability in Fetchmail is a stack-based buffer overflow that occurs during NTLM authentication. This flaw, identified as CVE-2026-94184, can be exploited by an attacker to execute arbitrary code, potentially leading to unauthorized access to sensitive information or system compromise. The issue arises from improper handling of input data, which allows for buffer overflow conditions, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
6.4.24-1.el8_10.1
This is the first release that contains the fix.
sudo dnf update fetchmailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable NTLM authentication in Fetchmail configurations until the package is updated. This can be done by modifying the configuration file to avoid using NTLM, thereby mitigating the risk of exploitation.
Conclusion
The identified vulnerability in Fetchmail poses a significant risk due to the potential for arbitrary code execution via NTLM authentication. Users are strongly advised to update to the latest patched version to mitigate this risk. Additionally, temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for fetchmail →
FAQ
Fetchmail is a utility that retrieves and forwards emails from remote servers to local mail clients over TCP/IP connections.
The vulnerability is a stack-based buffer overflow that occurs during NTLM authentication, which can lead to arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, you can disable NTLM authentication in your Fetchmail configuration to reduce the risk of exploitation.
For more details, refer to the CVE page for CVE-2026-94184, which provides comprehensive information about the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for fetchmail.
