EIP-2026-118734

PRE-CVE

Magic Winmail Server 2.3 USER POP3 - Command Format String

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-118734. PoCs published by D4rkGr3y.

AI-analyzed exploit summary This exploit leverages a format string vulnerability in Magic Winmail Server 2.3 (Build 0402) via the SMTP protocol to achieve remote code execution. It uses crafted format specifiers to overwrite memory addresses and execute arbitrary commands via a custom shellcode.

Description

Magic Winmail Server 2.3 USER POP3 - Command Format String

Exploits (1)

exploitdb WORKING POC VERIFIED
by D4rkGr3y · cremotewindows
https://www.exploit-db.com/exploits/22635

This exploit leverages a format string vulnerability in Magic Winmail Server 2.3 (Build 0402) via the SMTP protocol to achieve remote code execution. It uses crafted format specifiers to overwrite memory addresses and execute arbitrary commands via a custom shellcode.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Magic Winmail Server 2.3 (Build 0402)
No auth needed
Prerequisites: Network access to the SMTP port (default 25) · Vulnerable version of Magic Winmail Server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026