$ cve CVE-2006-1255 JSON

CVE-2006-1255 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 68.8% (pctl 99)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	68.77% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-03-19
Last modified	2026-06-16

Affected (1)

Vendor	Product
mercur	mercur messaging

Public exploits

Source	Title	Date
exploit-db	Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)	2010-09-20
exploit-db	Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit)	2010-08-25
exploit-db	Mercur Messaging 2005 < SP4 - IMAP Remote (Egghunter)	2007-03-21
exploit-db	Mercur Messaging 2005 - IMAP Remote Buffer Overflow	2007-01-15
exploit-db	Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (2)	2006-09-11
exploit-db	Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (1)	2006-03-19

References

→ the Explorer · watch your stack · NVD