CVE-2026-94184: Fetchmail Buffer Overflow Vulnerability

CVE-2026-94184 Overview

A stack-based buffer overflow [CWE-121] exists in fetchmail when compiled with NTLM authentication support. A malicious or compromised mail server that advertises NTLM authentication can send a crafted Type 2 challenge. The crafted challenge causes fetchmail to write past a fixed-size stack buffer while constructing the NTLM authenticate response. Depending on stack-frame layout and compiler hardening, exploitation can lead to remote code execution, authentication failure, or process termination. The flaw affects fetchmail versions v5.0.8 through v6.6.6.

Critical Impact
A hostile IMAP or POP3 server can corrupt the fetchmail client's stack and potentially execute code in the context of the user retrieving mail.

Affected Products

Fetchmail v5.0.8 through v6.6.6 built with NTLM support
Linux distributions packaging vulnerable fetchmail builds (see Red Hat advisory)
Any mail retrieval workflow configured to use NTLM authentication against remote POP3, IMAP, or SMTP servers

Discovery Timeline

2026-09-21 - CVE-2026-94184 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94184

Vulnerability Analysis

The defect resides in the NTLM authentication path of fetchmail. During NTLM negotiation, a client sends a Type 1 message, the server replies with a Type 2 challenge, and the client returns a Type 3 authenticate response. Fetchmail parses the server-supplied Type 2 challenge and uses fields from it to build the Type 3 response on a fixed-size stack buffer. When the attacker-controlled challenge specifies oversized or malformed length fields, the response construction writes beyond the buffer boundary. The upstream fix is tracked in commit cb5be5c38471eec19e519ace0bc569176317ea92.

Root Cause

The root cause is missing bounds validation on attacker-controlled length and offset values inside the NTLM Type 2 message before they are used to size copy operations into a stack buffer. This is a classic stack-based buffer overflow classified as [CWE-121].

Attack Vector

Exploitation requires the victim fetchmail client to connect to a server that offers NTLM authentication. An attacker who controls the mail server, has compromised it, or can perform a network-position attack against a plaintext session can deliver the malicious Type 2 challenge. No user interaction beyond the normal mail poll is required, and no authentication to the target host is required.

No verified public exploit code is available. For technical details, see the Fetchmail Security Advisory 2026-01 and the upstream fix commit.

Detection Methods for CVE-2026-94184

Indicators of Compromise

Unexpected crashes, SIGSEGV, or stack-smashing termination messages from the fetchmail process during mail retrieval
Fetchmail sessions negotiating NTLM authentication against unfamiliar or newly reconfigured mail servers
Outbound POP3, IMAP, or SMTP connections from mail hosts to domains not in the approved mail provider list

Detection Strategies

Inventory hosts running fetchmail and identify builds compiled with NTLM support at versions 5.0.8 through 6.6.6
Alert on process termination or core dumps for fetchmail correlated with active POP3 or IMAP sessions
Inspect mail server configurations pulled by fetchmail for unexpected advertisement of NTLM authentication

Monitoring Recommendations

Forward fetchmail logs, syslog abrt events, and kernel segfault records to a central logging pipeline for correlation
Monitor egress connections from mail-processing servers on TCP 110, 143, 995, and 993 to detect connections to unauthorized destinations
Track package versions of fetchmail across the fleet and flag any host still running an unpatched release

How to Mitigate CVE-2026-94184

Immediate Actions Required

Upgrade fetchmail to a release that includes commit cb5be5c38471eec19e519ace0bc569176317ea92 or the vendor backport
Disable NTLM authentication in .fetchmailrc configurations where an alternative such as password, CRAM-MD5, or OAuth2 is available
Restrict fetchmail polling to trusted mail servers reachable over TLS-protected channels only

Patch Information

The upstream fix is available in the fetchmail GitLab repository as commit cb5be5c38471eec19e519ace0bc569176317ea92. Red Hat tracks distribution updates under Red Hat CVE-2026-94184 and Bugzilla #2537395. Details are documented in Fetchmail Security Advisory 2026-01.

Workarounds

Rebuild fetchmail without NTLM support if patching is not immediately feasible
Force a non-NTLM authentication mechanism per-account in the fetchmail configuration file
Enforce TLS for all POP3 and IMAP sessions to reduce exposure to network-position attackers injecting malicious challenges

bash

# Example .fetchmailrc entry that avoids NTLM
poll mail.example.com protocol IMAP
  user "alice" there with password "REDACTED"
  auth password
  ssl
  sslcertck