BSD PortsFetchmail -- NTLM potential remote code execution
· CVE-2026-94184 · VuXML entry
Fetchmail reports: [CVE-2026-94184]: Fetchmail's NTLM authentication client can in some cases be susceptible to a remote code execution from a malicious server when fetchmail is configured with the NTLM feature enabled, depending on build details. fetchmail 6.6.7 release candidates, 6.6.7 and subsequent releases are unaffected.
Affected versions
- fetchmail >= 5.0.8 < 6.6.7
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | mail/fetchmail | 6.5.4 | vulnerable since 2026-09-26 | |
| OpenBSD | mail/fetchmail | 6.6.9 | out of range, by version | |
| NetBSD | mail/fetchmail | 6.6.2 | not listed | |
| MidnightBSD | mail/fetchmail | 6.6.6 | in range, by version | |
| FreeBSD | mail/fetchmail | 6.6.9 | fixed |