Every CVE Search/ Get API key

CVE-2020-8794

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in...

9.8 CriticalPublic exploitFix available

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

88.9%Up 25.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
CVE-2020-8794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
CVE-2020-8794
Updated
2026-11-02
EUVDEUVD-2020-29642 No score

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
EUVD-2020-29642
Updated
2026-11-03
GitHub AdvisoriesGHSA-hmw3-c3g9-px9f 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in...

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
GHSA-hmw3-c3g9-px9f
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2020-8794 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
ALPINE-CVE-2020-8794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
CVE-2020-8794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2020-8794 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
DEBIAN-CVE-2020-8794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8794 9.8

OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

Record
UBUNTU-CVE-2020-8794
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUSN-4294-1 No score

OpenSMTPD vulnerabilities

It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use this vulnerability to execute arbitrary shell commands as any non-root user. (CVE-2020-8794)

It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An unprivileged local attacker could read the first line of any file on the filesystem. (CVE-2020-8793)

Record
USN-4294-1
Updated
2026-11-02
OSVUSN-4875-1 No score

opensmtpd vulnerabilities

It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as root. (CVE-2020-7247)

It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An unprivileged local attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-8793)

It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could possibly use this vulnerability to execute arbitrary shell commands as any non-root user. This issue only affected Ubuntu 16.04 ESM. (CVE-2020-8794)

Record
USN-4875-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
opensmtpd-extras
Alpine:v3.13
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.14
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.15
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.16
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.17
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.18
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.19
 before 6.6.4-r0
6.6.4-r0
opensmtpd-extras
Alpine:v3.20
 before 6.6.4-r0
6.6.4-r0
opensmtpd
Debian:12
 before 6.6.4p1-1
6.6.4p1-1
opensmtpd
Debian:13
 before 6.6.4p1-1
6.6.4p1-1
Show 9 moreShow less
Affected packages
PackageAffectedFixed
opensmtpd
Debian:14
 before 6.6.4p1-1
6.6.4p1-1
opensmtpd
Debian:9
 before 6.0.2p1-2+deb9u3, plus listed versions
6.0.2p1-26.0.2p1-2+deb9u16.0.2p1-2+deb9u2
6.0.2p1-2+deb9u3
opensmtpd
Debian:10
 before 6.0.3p1-5+deb10u4, plus listed versions
6.0.3p1-56.0.3p1-5+deb10u16.0.3p1-5+deb10u26.0.3p1-5+deb10u3
6.0.3p1-5+deb10u4
opensmtpd
Ubuntu:Pro:16.04:LTS
 before 5.7.3p2-1ubuntu0.1~esm2, plus listed versions
5.4.2p1-45.7.3p1-15.7.3p2-15.7.3p2-1ubuntu0.1~esm1
5.7.3p2-1ubuntu0.1~esm2
opensmtpd
Ubuntu:18.04:LTS
 before 6.0.3p1-1ubuntu0.2, plus listed versions
6.0.2p1-2build16.0.3p1-16.0.3p1-1build16.0.3p1-1ubuntu0.1
6.0.3p1-1ubuntu0.2
opensmtpd
Ubuntu:20.04:LTS
 before 6.6.4p1-1, plus listed versions
6.0.3p1-66.0.3p1-6build16.6.1p1-16.6.1p1-36.6.1p1-46.6.1p1-56.6.2p1-1
6.6.4p1-1
opensmtpd
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 6.0.3p1-1ubuntu0.2, plus listed versions
6.0.2p1-2build16.0.3p1-16.0.3p1-1build16.0.3p1-1ubuntu0.1
6.0.3p1-1ubuntu0.2
opensmtpd
Ubuntu:Pro:14.04:LTS
From an advisory covering 3 CVEs
 before 5.4.1p1-1ubuntu0.1~esm1, plus listed versions
5.3.3p1-45.4.1p1-1
5.4.1p1-1ubuntu0.1~esm1
opensmtpd
Ubuntu:Pro:16.04:LTS
From an advisory covering 3 CVEs
 before 5.7.3p2-1ubuntu0.1~esm2, plus listed versions
5.4.2p1-45.7.3p1-15.7.3p2-15.7.3p2-1ubuntu0.1~esm1
5.7.3p2-1ubuntu0.1~esm2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitOpenSMTPD OOB Read Local Privilege Escalation2020-02-24
Exploit-DBOpenSMTPD < 6.6.3p1 - Local Privilege Escalation + Remote Code Execution2020-02-26
Exploit-DBOpenSMTPD - OOB Read Local Privilege Escalation (Metasploit)2020-03-09

History

History
RecordedChangedSources
affected, facts
affected, aliases, exploits, referencesOSV
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8794 is a critical vulnerability (CVSS 9.8) in Opensmtpd, published February 25, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 88.9%, the 99th percentile. Fixed in opensmtpd-extras 6.6.4-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open