CVE-2003-0694: Sendmail prescan buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication, and complete confidentiality, integrity, and availability impact, combined with a very high EPSS percentile, makes this a top remediation priority despite the absence of KEV listing.

What it is

The prescan function in Sendmail 8.12.9 contains a buffer overflow reachable through crafted email addresses, as demonstrated via the parseaddr function in parseaddr.c. Because Sendmail is a mail transfer agent that processes untrusted message data, the flaw exposes mail servers to remote compromise without any prior access.

Impact

An attacker can execute arbitrary code with the privileges of the Sendmail process, which on many deployments is root or a privileged user. That yields full control of the mail server, including reading mail, altering configuration, and pivoting into the host network.

Attack surface

The flaw is reached over the network by sending a specially crafted message or address that is parsed by Sendmail's prescan/parseaddr logic. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

The record does not list this CVE in CISA KEV and provides no exploit-tagged references, but EPSS is 0.66183 (99.2nd percentile), indicating a high modeled likelihood of exploitation activity. No ransomware group is documented as using it.

What to do

• Upgrade to Sendmail 8.12.10 or later, or apply the vendor patch referenced in the CERT/CC advisory CA-2003-25 and the sendmail.org 8.12.10 release notes.
• Apply the operating system vendor errata for affected platforms (Red Hat, Debian, Mandriva, SCO, and others listed in the references).
• If immediate patching is not possible, restrict SMTP exposure to trusted relays and disable unnecessary mail processing features.
• Run Sendmail with least privilege where the platform supports it, so a successful overflow does not yield root.
• Monitor vendor advisories for the affected distributions and confirm the installed Sendmail version is not 8.12.9.

Detection

• Inspect mail server logs for crashes, restarts, or abnormal Sendmail process termination that could indicate a failed overflow attempt.
• Monitor for unexpected child processes or outbound connections spawned by the Sendmail daemon.
• Check file integrity of Sendmail binaries and configuration files for unauthorized modification.
• Use network monitoring to flag malformed or unusually long address strings in SMTP traffic targeting the MTA.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.