← Vulnerability feed

Vulnerability record · CVE-2026-43964 · published 4 May 2026

CVE-2026-43964: Postfix vulnerability

Postfix · Postfix

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

7.5 CVSS 3.1 High EPSS 0.88% · top 42.4% CWE-193 · CWE-193
7.5CVSS 3.1 base score
0.88%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References
20 Aug 2026Last modified by NVD

Description

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.mail-archive.com/[email protected]/msg00110.html Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/30 Mailing ListThird Party Advisory
https://access.redhat.com/errata/RHSA-2026:25930
https://access.redhat.com/errata/RHSA-2026:25932
https://access.redhat.com/errata/RHSA-2026:26205
https://access.redhat.com/errata/RHSA-2026:50963
https://access.redhat.com/errata/RHSA-2026:50964
https://access.redhat.com/errata/RHSA-2026:51034
https://access.redhat.com/errata/RHSA-2026:51436
https://access.redhat.com/errata/RHSA-2026:57174
https://access.redhat.com/security/cve/CVE-2026-43964
https://bugzilla.redhat.com/show_bug.cgi?id=2466488
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43964.json

Track CVE-2026-43964 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2017-10140Postfix vulnerabilityPostfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undo…EPSS 0.55%6.9CVE-2009-2939Postfix link following vulnerabilityThe postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, …EPSS 0.50%6.9CVE-2008-4977Postfix link following vulnerabilitypostfix_groups.pl in Postfix 2.5.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/postfix_groups.stdout, (2) /t…EPSS 0.37%6.8CVE-2011-1720Postfix memory buffer overflow vulnerabilityThe SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication met…EPSS 21%6.8CVE-2011-0411Postfix permissions and access controls vulnerabilityThe STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restric…EPSS 16%6.5CVE-2012-0811Postfix sql injection vulnerabilityMultiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL com…EPSS 1.7%6.2CVE-2008-2936Postfix permissions and access controls vulnerabilityPostfix before 2.3.15, 2.4 before 2.4.8, 2.5 before 2.5.4, and 2.6 before 2.6-20080814, when the operating system supports hard links to symlinks, al…EPSS 0.99%5.3CVE-2023-51764Postfix insufficient verification of data authenticity vulnerabilityPostfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=c…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2026-43964), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.