CVE-2020-8794

CRITICAL

OpenSMTPD OOB Read Local Privilege Escalation

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 3 public exploits for CVE-2020-8794. PoCs published by Metasploit, Qualys Corporation, Qualys, wvu, including Metasploit module exploits/unix/local/opensmtpd_oob_read_lpe.

AI-analyzed exploit summary This Metasploit module exploits CVE-2020-8794, an out-of-bounds read vulnerability in OpenSMTPD, to achieve local privilege escalation. It leverages a malformed SMTP message to execute arbitrary commands as root or nobody, depending on the OpenSMTPD grammar version.

Description

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Exploits (3)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocallinux
https://www.exploit-db.com/exploits/48185

This Metasploit module exploits CVE-2020-8794, an out-of-bounds read vulnerability in OpenSMTPD, to achieve local privilege escalation. It leverages a malformed SMTP message to execute arbitrary commands as root or nobody, depending on the OpenSMTPD grammar version.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: OpenSMTPD < 6.6.4
No auth needed
Prerequisites: Local access to a vulnerable OpenSMTPD instance · OpenSMTPD service running
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC
by Qualys Corporation · cremoteopenbsd
https://www.exploit-db.com/exploits/48140

This exploit demonstrates a local privilege escalation (LPE) and remote code execution (RCE) vulnerability in OpenSMTPD's default installation. It leverages a flaw in the SMTP server's grammar parsing to inject arbitrary commands, allowing an attacker to execute code as the root user.

Classification
Working Poc 100%
Attack Type
Rce | Lpe
Complexity
Moderate
Reliability
Reliable
Target: OpenSMTPD (versions with CVE-2020-8794)
No auth needed
Prerequisites: Network access to the SMTP service (port 25) · OpenSMTPD running with vulnerable configuration
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Qualys, wvu · rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/local/opensmtpd_oob_read_lpe.rb

This Metasploit module exploits CVE-2020-8794, an out-of-bounds read vulnerability in OpenSMTPD, to achieve local privilege escalation by sending a malformed SMTP message to execute arbitrary commands as root or nobody, depending on the grammar version.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: OpenSMTPD < 6.6.4
No auth needed
Prerequisites: Local access to the target system · OpenSMTPD service running · Network connectivity to the Metasploit handler
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (11)

Core 11
Core References
Third Party Advisory x_refsource_misc
https://www.openbsd.org/security.html
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/02/24/5
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/02/26/1
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4634
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2020/Feb/32
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/03/01/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2020/03/01/2
Patch, Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4294-1/
Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/05/04/7

Scores

CVSS v3 9.8
EPSS 0.8814
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-125
Status published
Products (7)
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.10
debian/debian_linux 9.0
debian/debian_linux 10.0
fedoraproject/fedora 31
fedoraproject/fedora 32
opensmtpd/opensmtpd < 6.6.4
Published Feb 25, 2020
Tracked Since Feb 18, 2026