CVE-2026-43964
Low · 3.7CVSS
3.7
EPSS
0.9%
Published
May 4, 2026
CISA due date
—
The record
Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | postfix | 0 | 3.10.2-160000.3.1 |
| openSUSE:Leap 16.0 | postfix-bdb | 0 | 3.10.2-160000.3.1 |
| openSUSE:Tumbleweed | postfix | 0 | 3.11.2-1.1 |
Related vulnerabilities
- CVE-2023-51764 Postfix through 3.8.5 allows SMTP smuggling unless configured with… Also affects postfix
- CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in… CWE-193
- CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times… CWE-193
- CVE-2026-90781 alsa-lib through 1.2.16.1 contains a stack buffer overflow in the… CWE-193
- CVE-2026-86297 A vulnerability was identified in D-Link DIR-605 B1v202WWB03. CWE-193
- CVE-2026-81738 OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to… CWE-193
- CVE-2026-57160 PJSIP is a free and open source multimedia communication library written in C. CWE-193
- CVE-2026-17469 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial… CWE-193