Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2019-25364: MailCarrier 2.51 allows remote code execution via oversized POP3 command
CVE-2019-25364 · published 8 months ago
Summary
A security flaw in MailCarrier 2.51 makes it possible for an attacker to send a malicious command that can take control of your server. This can happen if an attacker sends a specially crafted message to the MailCarrier POP3 server. To protect your server, update MailCarrier to the latest version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tabslab | mailcarrier |
2.51 cpe:2.3:a:tabslab:mailcarrier:2.51:*:*:*:*:*:*:* |
Original advisory text
MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 ...
MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote system access.
References
- https://www.exploit-db.com/exploits/47554 Exploit Third Party Advisory
- https://www.tabslab.com/ Product
- https://www.vulncheck.com/advisories/win-mailcarrier-pop-user-remote-buffer-over... Broken Link
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-121Stack-based Buffer Overflow
Timeline
Published18 Feb 2026
Updated3 Nov 2026
First seen6 Mar 2026
Sources
CVE-2019-25364 · NVD
Track software like this
Free during beta