CVE-2005-2278: MailEnable IMAP daemon stack buffer overflow via status command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityRemote authenticated code execution on a mail server with public exploit code and very high EPSS, though it requires valid credentials and affects an old product version.

What it is

MailEnable Professional 1.54 contains a stack-based buffer overflow in its IMAP daemon (imapd) triggered by the status command when given an overly long mailbox name. A remote authenticated user can overflow the stack and potentially execute arbitrary code on the mail server. The flaw matters because it lets a low-privileged mail account holder attack the server itself, not just their own mailbox.

Impact

An attacker with valid IMAP credentials gains the ability to run arbitrary code with the privileges of the imapd process, which typically means full compromise of the mail server. This can lead to data theft, mail interception, or use of the host as a pivot point.

Attack surface

The flaw is reached over the network through the IMAP service by sending a crafted status command with a long mailbox name. Authentication is required, since the description states remote authenticated users; no user interaction beyond the IMAP session is needed.

Exploitation

No CISA KEV listing exists, but EPSS is very high (0.8464, ~99.7th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit code is available. The record does not state whether exploitation has been observed in the wild.

What to do

• Upgrade MailEnable Professional to a version later than 1.54 that fixes the imapd status command overflow.
• If immediate upgrade is not possible, restrict IMAP access to trusted networks and disable the service where it is not needed.
• Enforce strong unique credentials and monitor for unusual IMAP accounts, since exploitation requires authentication.
• Apply the vendor patch referenced in the Core Security advisory and verify the imapd binary version after updating.

Detection

• Inspect IMAP logs for status commands containing abnormally long mailbox names or malformed arguments.
• Monitor for imapd process crashes or restarts, which can indicate failed overflow attempts.
• Watch for unexpected child processes or outbound connections originating from the mail server host.
• Alert on repeated authentication followed by anomalous IMAP command patterns from a single account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.