CVE-2003-0714: Exchange Internet Mail Service extended verb request causes memory exhaustion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated remote denial of service against internet-facing mail with a very high EPSS score and public exploit references, though no confirmed code execution or KEV listing.

What it is

The Internet Mail Service in Exchange Server 5.5 and Exchange 2000 mishandles a certain extended SMTP verb request, allowing remote attackers to exhaust memory and cause a denial of service; the description also notes a possible buffer overflow in Exchange 2000. The flaw is remotely reachable over the SMTP service with no authentication, so any host able to reach the mail port can attempt it.

Impact

An attacker can crash or degrade the mail service through memory exhaustion, disrupting mail delivery; the record hints at a possible buffer overflow in Exchange 2000, but does not confirm code execution.

Attack surface

Reached by directly connecting to the SMTP service and sending a crafted extended verb request; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.776, 99.5th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.

What to do

• Apply the Microsoft security bulletin MS03-046 update for Exchange Server 5.5 and Exchange 2000
• Restrict SMTP access to trusted mail relays and hosts using firewall or network ACLs
• Disable or block unnecessary extended SMTP verbs at the mail gateway where feasible
• Monitor Exchange memory and service availability for abnormal spikes or restarts

Detection

• Alert on Exchange SMTP service crashes, restarts or memory exhaustion events
• Log and review SMTP sessions issuing unusual or malformed extended verb commands
• Baseline normal SMTP verb usage and flag deviations from expected mail flow

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.