Description
Fetchmail (aka fetchmail-ssl) before 5.8.17 allows a remote malicious (1) IMAP server or (2) POP/POP3 server to overwrite arbitrary memory and possibly gain privileges via a negative index number as part of a response to a LIST request.
Exploits (2)
exploitdb
WORKING POC
VERIFIED
by Salvatore Sanfilippo -antirez- · cremoteunix
https://www.exploit-db.com/exploits/21064
exploitdb
WORKING POC
VERIFIED
by Sanfillipo antirez · cremoteunix
https://www.exploit-db.com/exploits/21066
References (10)
Scores
EPSS
0.3326
EPSS Percentile
96.9%
Details
CWE
CWE-264
Status
published
Products (50)
fetchmail/fetchmail
4.5.1
fetchmail/fetchmail
4.5.2
fetchmail/fetchmail
4.5.3
fetchmail/fetchmail
4.5.4
fetchmail/fetchmail
4.5.5
fetchmail/fetchmail
4.5.6
fetchmail/fetchmail
4.5.7
fetchmail/fetchmail
4.5.8
fetchmail/fetchmail
4.6.0
fetchmail/fetchmail
4.6.1
... and 40 more
Published
Aug 31, 2001
Tracked Since
Feb 18, 2026