Skip to content
Fencer Vulns
critical 10.0

CVE-2004-1211 in the critical feed json

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (applicatio…

published 2004-12-15 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-1208

cvss
10.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
72.5%
EPSS 72.5% chance of exploitation in 30 days, percentile 99.4%
public exploits
8
Metasploit, Exploit-DB

Summary

Multiple buffer overflows in the IMAP service in Mercury/32 4.01a allow remote authenticated users to cause a denial of service (application crash) and possibly execute arbitrary code via long arguments to the (1) EXAMINE, (2) SUBSCRIBE, (3) STATUS, (4) APPEND, (5) CHECK, (6) CLOSE, (7) EXPUNGE, (8) FETCH, (9) RENAME, (10) DELETE, (11) LIST, (12) SEARCH, (13) CREATE, or (14) UNSUBSCRIBE commands.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/windows/imap/mercury_rename)
  2. Published

Exploit prediction

72.46% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/imap/mercury_rename Mercury/32 v4.01a IMAP RENAME Buffer Overflow metasploit exploit, average rank, 2004-11-29
  • EDB-16484 Mercury/32 Mail Server 4.01a - IMAP RENAME Buffer Overflow (Metasploit) remote, 2010-05-09
  • EDB-4316 Mercury/32 Mail Server 3.32 < 4.51 - SMTP EIP Overwrite remote, 2007-08-26
  • EDB-3561 Mercury/32 Mail Server 4.0.1 - 'LOGIN' Remote IMAP Stack Buffer Overflow remote, 2007-03-24
  • EDB-1159 Mercury/32 Mail Server 4.01a - 'check' Buffer Overflow dos, 2004-12-01
  • EDB-670 Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (2) remote, 2004-12-01
  • EDB-668 Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (1) remote, 2004-11-30
  • EDB-663 Mercury/32 Mail Server 4.01 - 'Pegasus' IMAP Buffer Overflow (3) remote, 2004-11-29
  • securityfocus.com http://www.securityfocus.com/bid/11775 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.