CVE-2005-4267: Qualcomm WorldMail IMAP stack buffer overflow via long commands

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is a remotely reachable, unauthenticated stack buffer overflow with public exploit references and very high EPSS, though it is not in KEV and affects an old product.

What it is

Qualcomm WorldMail 3.0 contains a stack-based buffer overflow in its IMAP service. A remote attacker can send an overly long IMAP command ending in a "}" character to overwrite stack memory and potentially execute arbitrary code. The flaw is remotely reachable and requires no authentication, making it a serious pre-auth risk for exposed mail servers.

Impact

An attacker can corrupt stack memory and potentially execute arbitrary code with the privileges of the WorldMail IMAP service. Successful exploitation could lead to full compromise of the mail server host.

Attack surface

The flaw is reached over the network through the IMAP service by sending crafted long commands such as LIST, LSUB, SEARCH TEXT, STATUS INBOX, AUTHENTICATE, FETCH, SELECT, or COPY. The CVSS vector AV:N/AC:L/Au:N indicates no authentication is required and no user interaction is needed.

Exploitation

CVE-2005-4267 is not listed in CISA KEV, but public references are tagged Exploit, indicating proof-of-concept or exploit code is publicly available. EPSS shows a 30-day probability of 0.66803 (99.256th percentile), suggesting high predicted exploitation activity.

What to do

• Apply the vendor patch or upgrade Qualcomm WorldMail to a fixed version if one is available; the record does not specify affected or fixed versions.
• Restrict network access to the IMAP service to trusted hosts only, and block IMAP from the public internet where possible.
• Place the IMAP service behind a filtering proxy or intrusion prevention system that can drop malformed or oversized IMAP commands.
• Monitor vendor and security advisories for WorldMail 3.0 since the record does not list a confirmed fixed release.
• If the product is end-of-life and no patch exists, migrate to a supported mail server or isolate the service on a segmented network.

Detection

• Inspect IMAP server logs for unusually long commands or commands ending with a "}" character, especially LIST, LSUB, SEARCH TEXT, STATUS INBOX, AUTHENTICATE, FETCH, SELECT, and COPY.
• Monitor for crashes, restarts, or abnormal process termination of the WorldMail IMAP service.
• Use network IDS/IPS signatures for oversized IMAP commands and known exploit patterns against WorldMail.
• Alert on unexpected outbound connections or child processes spawned by the IMAP service, which may indicate code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.