CVE-2004-1211: Mercury/32 IMAP service buffer overflows via long command arguments

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with a very high EPSS score and public exploit availability, though it requires valid IMAP credentials and affects an old product version.

What it is

Mercury/32 4.01a contains multiple buffer overflows in its IMAP service, triggered by long arguments to fourteen different IMAP commands including EXAMINE, SUBSCRIBE, STATUS, APPEND, FETCH, SEARCH, and CREATE. A remote authenticated user can crash the service and possibly execute arbitrary code, making this a serious flaw for any deployment exposing the IMAP service.

Impact

An attacker with valid IMAP credentials can crash the mail service and potentially execute arbitrary code in the context of the Mercury/32 process. Successful code execution would give the attacker control over the mail server and any data it handles.

Attack surface

The flaw is reached over the network through the IMAP service; the CVSS vector indicates no authentication is required, but the description states the attacker must be a remote authenticated user, so valid IMAP credentials are needed. No user interaction is required beyond sending crafted IMAP commands.

Exploitation

CVE-2004-1211 is not listed in CISA KEV, but EPSS is very high at 0.72459 (99.4th percentile), and a reference is tagged Exploit, indicating public exploit code exists.

What to do

• Upgrade Mercury/32 to a version later than 4.01a that fixes the IMAP buffer overflows.
• If upgrading is not immediately possible, restrict IMAP access to trusted networks or disable the IMAP service until patched.
• Enforce strong, unique credentials and monitor for unusual IMAP command patterns from authenticated accounts.
• Apply the vendor patch referenced in the SecurityFocus advisory (BID 11775).

Detection

• Monitor IMAP server logs for abnormally long arguments to EXAMINE, SUBSCRIBE, STATUS, APPEND, CHECK, CLOSE, EXPUNGE, FETCH, RENAME, DELETE, LIST, SEARCH, CREATE, or UNSUBSCRIBE commands.
• Alert on Mercury/32 process crashes or restarts correlated with IMAP traffic.
• Use network IDS/IPS signatures for oversized IMAP command arguments targeting the Mercury/32 service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.