Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Forcepoint Email Security 8.5 can crash from crafted input

CVE-2018-16530 · published 7 years ago
Summary

The 8.5 version of Forcepoint Email Security may stop working if it receives specially crafted data, leading to a denial‑of‑service condition. While a full system takeover has not been observed, the nature of the flaw means it could potentially be exploited further. Install any available updates and follow vendor guidance to keep the system patched and monitored.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
forcepoint email_security 8.5.0
8.5.3
cpe:2.3:a:forcepoint:email_security:8.5.0:*:*:*:*:*:*:*
Original advisory text
A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service. While no known Remot...
A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service. While no known Remote Code Execution (RCE) vulnerabilities exist, as with all buffer overflows, the possibility of RCE cannot be completely ruled out. Data Execution Protection (DEP) is already enabled on the Email appliance as a risk mitigation.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published9 Apr 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-16530 · NVD
Track software like this
Free during beta