CVE-2026-43964

HIGH

7.5

CVSS Score

Published: May 4, 2026 at 06:10 PM UTC

Updated: August 20, 2026 at 02:45 PM UTC

1 product affected across 1 vendorPostfix

Using Postfix by Postfix?

Get instant alerts when new vulnerabilities affect Postfix - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 0.5%

SSVC

No known exploit

Description

Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Postfix · Postfix

95%

v < 3.8.162.3 ≤ v < 3.8.163.10 ≤ v < 3.10.93.10.0 ≤ v < 3.10.93.9 ≤ v < 3.9.103.9.0 ≤ v < 3.9.102.3 3.10 3.9

Affected range stops below 3.10.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.8.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.9.10, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (13)

Mailing ListThird Party Advisory

Source: cverecord

https://www.mail-archive.com/[email protected]/msg00110.html

Mailing ListThird Party Advisory

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2026/05/04/30