CVE-2007-1579: Atrium MERCUR IMAPD SUBSCRIBE stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated stack overflow with public exploit code and very high EPSS, though KEV absence and an old, thin record temper the rating.

What it is

Atrium MERCUR IMAPD contains a stack-based buffer overflow reachable through a certain SUBSCRIBE command. The record does not specify the exact malformed input or the resulting impact beyond 'unknown', but a remote, unauthenticated overflow in an IMAP service is a serious exposure.

Impact

An attacker could corrupt stack memory in the IMAP daemon, potentially leading to remote code execution or a crash; the record states the impact is unknown, so the exact gain is not confirmed.

Attack surface

The flaw is reached over the network via the IMAP protocol using a SUBSCRIBE command, per the AV:N/AC:L/Au:N vector, so no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no ransomware associations, but EPSS is 0.56209 (99th percentile) and public exploit code exists in Exploit-DB and an Immunity partner download, indicating mature public exploitation.

What to do

• Apply the vendor patch or upgrade MERCUR IMAPD to a fixed release; no fixed version is named in this record, so confirm with Atrium.
• If patching is not possible, restrict IMAP access to trusted networks and disable or block the SUBSCRIBE command where the server allows it.
• Place the IMAP service behind a filtering proxy or WAF that can reject oversized SUBSCRIBE arguments.
• Run the IMAP daemon with least privilege and isolate it so a compromise cannot reach other services.
• Monitor vendor advisories for updated guidance since the record is old and may not reflect current fixes.

Detection

• Inspect IMAP server logs for SUBSCRIBE commands with unusually long or malformed arguments.
• Alert on IMAP daemon crashes or restarts, which can indicate a failed overflow attempt.
• Use network IDS signatures for the public Exploit-DB PoC traffic against port 143/993.
• Baseline normal SUBSCRIBE usage and flag anomalous source IPs or command lengths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.