Vulnerability Description
MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first parameter whose name it cannot read, such as x:y=1 or a name containing an 8-bit byte, and drops every parameter after it. When the boundary is among them, MIME::Parser keeps the multipart body as a single undecoded part without marking the parse as ambiguous. Mail readers that skip the invalid parameter still find the boundary. A remote sender can hide an attachment from a filter that relies on ambiguous_content() while the recipient's mail client shows it.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-116264?
CVE-2026-116264 is a documented vulnerability. MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-Type parameter to hide the parameters after it, including the multipart boundary. Parameter parsing stops at the first p...
How severe is CVE-2026-116264?
CVSS scoring is not yet available for CVE-2026-116264. Check NVD for updates.
Is there a patch for CVE-2026-116264?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.