CVE-2026-94184

A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

While the underlying stack-based buffer overflow in fetchmail's NTLM authentication handling is present in the source code, the compiler's stack variable layout in these builds places the vulnerable buffer adjacent to a larger variable that absorbs the overflow before it can reach the stack canary or return address. As a result, triggering this flaw in any Red Hat-shipped build does not lead to remote code execution; the observed effect is a corrupted NTLM negotiation flag that causes authentication to fail.

Red Hat recommends customers update to a fixed fetchmail package when it becomes available as a defense-in-depth measure, even though exploitation for code execution has not been demonstrated on shipped builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Rebuild fetchmail without --enable-NTLM (omit NTLM at configure time). Confirm with fetchmail -V that the build does not list +NTLM.