CVE-2003-1200: Alt-N MDaemon FORM2RAW.exe stack buffer overflow via From parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution in an internet-facing mail component with public exploit references and very high EPSS, though no KEV listing or confirmed in-the-wild ransomware use.

What it is

FORM2RAW.exe in Alt-N MDaemon 6.5.2 through 6.8.5 contains a stack-based buffer overflow reachable through a long From parameter passed to Form2Raw.cgi. A remote attacker can overwrite stack memory and potentially execute arbitrary code on the mail server. The flaw affects an unauthenticated network-reachable component, making it a serious pre-auth risk for exposed MDaemon installations.

Impact

Successful exploitation can allow a remote attacker to execute arbitrary code with the privileges of the FORM2RAW.exe process, potentially leading to full compromise of the mail server. At minimum, it can crash the component and disrupt mail processing.

Attack surface

The vulnerability is reached over the network via the Form2Raw.cgi interface by supplying an overly long From parameter. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and the attack is remotely reachable.

Exploitation

The record is not listed in CISA KEV, but EPSS is high at 0.65097 (99.2nd percentile) and multiple references are tagged Exploit, indicating public exploit information exists. No ransomware group usage is documented.

What to do

• Upgrade Alt-N MDaemon to a version later than 6.8.5 that addresses the FORM2RAW.exe overflow.
• If immediate upgrade is not possible, restrict network access to Form2Raw.cgi and the MDaemon web interface to trusted sources only.
• Disable or remove the Form2Raw.cgi component if it is not required for mail processing.
• Apply input length validation or a web application firewall rule to block oversized From parameters to Form2Raw.cgi.
• Monitor vendor advisories for MDaemon and apply any available hotfixes for the affected 6.5.2 through 6.8.5 range.

Detection

• Inspect web server and MDaemon logs for requests to Form2Raw.cgi with unusually long From parameter values.
• Monitor for crashes or abnormal process termination of FORM2RAW.exe on MDaemon hosts.
• Use network detection to alert on HTTP requests to Form2Raw.cgi containing long or malformed From fields.
• Correlate MDaemon host process creation events with unexpected child processes following Form2Raw.cgi activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.