An update for fetchmail is now available for openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-4208 Final 1.0 1.0 2026-09-30 Initial 2026-09-30 2026-09-30 openEuler SA Tool V1.0 2026-09-30 fetchmail security update An update for fetchmail is now available for openEuler-24.03-LTS-SP1 Fetchmail is a mail retrieval daemon that can download messages from POP3, IMAP, ODMR and ETRN-based stores, with SSL/TLS security including certificate verification, and pass downloaded mail to a local SMTP or LMTP server, or a message delivery agent such as maildrop. Security Fix(es): A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6.(CVE-2026-94184) An update for fetchmail is now available for openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High fetchmail https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4208 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-94184 https://nvd.nist.gov/vuln/detail/CVE-2026-94184 openEuler-24.03-LTS-SP1 fetchmail-6.4.37-3.oe2403sp1.aarch64.rpm fetchmail-debuginfo-6.4.37-3.oe2403sp1.aarch64.rpm fetchmail-debugsource-6.4.37-3.oe2403sp1.aarch64.rpm fetchmail-6.4.37-3.oe2403sp1.src.rpm fetchmail-6.4.37-3.oe2403sp1.x86_64.rpm fetchmail-debuginfo-6.4.37-3.oe2403sp1.x86_64.rpm fetchmail-debugsource-6.4.37-3.oe2403sp1.x86_64.rpm A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening. Affects v5.0.8 through v6.6.6. 2026-09-30 CVE-2026-94184 openEuler-24.03-LTS-SP1 High 8.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H fetchmail security update 2026-09-30 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4208