CVE-2001-1326 json
Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables i…
published 2001-05-29 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-1307
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 1
- Exploit-DB
Summary
Eudora 5.1 allows remote attackers to execute arbitrary code when the "Use Microsoft Viewer" option is enabled and the "allow executables in HTML content" option is disabled, via an HTML email with a form that is activated from an image that the attacker spoofs as a link, which causes the user to execute the form and access embedded attachments.
Patch / fix
- securityfocus.com/bid/2796 advisory
Timeline
- First public exploit (EDB-20888)
- Published
Exploit prediction
2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-20888 Qualcomm Eudora 5.1 - Hidden Attachment Execution remote, 2001-05-29
- securityfocus.com http://www.securityfocus.com/bid/2796 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/bid/2796
vdb-entry, exploit, patch, vendor-advisory
-
securityfocus.com
/archive/1/187128
mailing-list, vendor-advisory
Sources
- CVE List CVE-2001-1326
- NVD CVE-2001-1326
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.