CVE-2017-16844

What it actually does

Heap-based buffer overflow in the loadbuf function triggered by a hardcoded realloc size when processing a crafted email message, enabling denial of service or arbitrary code execution.

Why it matters to the business

Remote compromise of email processing servers handling inbound mail, potentially allowing attackers to run code, exfiltrate data, or pivot into internal systems; procmail's unmaintained status and lack of patches increase long-term exposure for organizations still relying on it.

How an attack unfolds

An attacker crafts an email message that exceeds the hardcoded buffer size in formail's loadbuf function, causing a heap overflow when the message is processed by procmail; successful exploitation can yield remote code execution without authentication.

How to fix it

Remove or replace procmail with a maintained mail filtering solution such as maildrop, postfix with built-in filtering, or modern MDA tools; audit and disable any remaining procmail invocations in mail delivery pipelines.

How to confirm the fix worked

Inventory all systems invoking procmail or formail, confirm version strings via package managers or binary inspection, and verify that no mail flows still route through the vulnerable binary.

Typical attack path

1. Craft a malicious email payload designed to trigger the hardcoded realloc in loadbuf
2. Deliver the message via SMTP to a recipient whose mail flow invokes procmail and formail
3. Trigger processing of the message body or headers in formisc.c
4. Achieve memory corruption leading to crash or arbitrary code execution

How to detect it

Review mail server logs for repeated procmail or formail crashes, unusually large or malformed message deliveries, and any child process anomalies following email receipt; correlate with SMTP logs showing inbound messages from untrusted sources.

What your security team should do

• Immediately inventory and isolate any remaining procmail deployments
• Migrate mail filtering logic to supported alternatives before the next audit cycle
• Add mail server logging for abnormal formail crashes or oversized message processing
• Block or sandbox legacy procmail binaries in production environments