CVE-2018-25223

Crashmail 1.6 Stack-based Buffer Overflow Remote Code Execution

CVSS 9.3 CRITICALEPSS 0.9%CWE-787

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.3EPSS 0.9%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

28 Mar 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads with ROP chains to achieve code execution in the application context, with failed attempts potentially causing denial of service.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

crashmail · Crashmail

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/44331unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://exploitpack.com http://ftnapps.sourceforge.net/crashmail.html https://www.exploit-db.com/exploits/44331 https://www.vulncheck.com/advisories/crashmail-stack-based-buffer-overflow-remote-code-execution