CVE-2007-4440: Mercury Mail MercuryS SMTP stack buffer overflow via AUTH CRAM-MD5

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution with public exploit references and very high EPSS, though no KEV listing and an uncertain affected version range.

What it is

Mercury Mail Transport System's MercuryS SMTP server has a stack-based buffer overflow triggered by a long AUTH CRAM-MD5 string. A remote, unauthenticated attacker can send an oversized SMTP command to corrupt memory and potentially execute arbitrary code. The record notes the affected version is possibly 4.51 and earlier, and that this may overlap CVE-2006-5961.

Impact

Successful exploitation can allow arbitrary code execution in the context of the SMTP service, giving an attacker control of the mail server process. Even without code execution, the overflow can crash the service and disrupt mail handling.

Attack surface

Reachable over the network through the SMTP service on MercuryS, with no authentication required and no user interaction. The CVSS vector AV:N/AC:L/Au:N confirms remote, low-complexity, unauthenticated access.

Exploitation

Public exploit references exist, including a SecurityFocus BID tagged Exploit and an Exploit-DB entry, and EPSS is high at 0.64513 (99.2nd percentile). CISA KEV does not list this CVE, so there is no confirmed in-the-wild exploitation record in this dataset.

What to do

• Upgrade Mercury Mail Transport System to a version later than 4.51 if available; the record only states 'possibly 4.51 and earlier' and does not name a fixed version.
• If upgrading is not possible, restrict SMTP access to trusted networks and disable or block the AUTH CRAM-MD5 mechanism where it is not required.
• Place the SMTP service behind a filtering proxy or IPS that can reject oversized AUTH CRAM-MD5 commands.
• Run the MercuryS service with least privilege and isolate it from other critical systems.
• Monitor vendor advisories for a definitive fixed version, since the affected range is uncertain.

Detection

• Inspect SMTP logs for unusually long AUTH CRAM-MD5 commands or malformed authentication attempts.
• Alert on MercuryS process crashes or restarts that correlate with SMTP authentication traffic.
• Use network IDS signatures for oversized AUTH CRAM-MD5 payloads against SMTP ports.
• Review exploit-db and public PoC traffic patterns against mail server logs for matching request strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.