Every CVE Search/ Get API key

CVE-2004-1211

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated...

10.0 HighPublic exploit

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Exploit likelihood

72.5%Down 4.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Record
CVE-2004-1211
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Record
CVE-2004-1211
Updated
2026-11-02
EUVDEUVD-2004-1208 No score

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Record
EUVD-2004-1208
Updated
2026-11-03
GitHub AdvisoriesGHSA-fvpw-h9g4-v5hg No score

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated...

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Record
GHSA-fvpw-h9g4-v5hg
Weakness
CWE-119
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBMercury/32 Mail Server 4.01a - 'check' Buffer Overflow2004-12-01
Exploit-DBMercury/32 Mail Server 4.01a - IMAP RENAME Buffer Overflow (Metasploit)2010-05-09
Exploit-DBMercury/32 Mail Server 4.0.1 - 'LOGIN' Remote IMAP Stack Buffer Overflow2007-03-24
Exploit-DBMercury/32 Mail Server 3.32 < 4.51 - SMTP EIP Overwrite2007-08-26
Exploit-DBMercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3)2004-11-29
Exploit-DBMercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (1)2004-11-30
Exploit-DBMercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (2)2004-12-01
MetasploitMercury/32 v4.01a IMAP RENAME Buffer Overflow2004-11-29

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2004-1211 is a high vulnerability (CVSS 10.0) in David Harris Mercury, published December 15, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.5%, the 99th percentile. No source names a fixed version.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open