CVE-2007-4440: Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and...

Security readout for executives and security teams

CVE-2007-4440 describes a memory corruption flaw in MercuryS SMTP, part of Mercury Mail Transport System. A remote attacker could potentially take control of the mail server by abusing SMTP authentication handling before login. The source data is old and incomplete, but the impact described is serious. Exposure is most likely where MercuryS SMTP is internet-facing or reachable by untrusted networks and CRAM-MD5 SMTP AUTH is enabled. The provided CVE data does not include authoritative CPEs, confirmed version ranges beyond “possibly 4.51 and earlier,” or deployment prevalence. Treat confirmed exposed instances as urgent legacy-risk remediation. The vulnerability could allow remote server compromise before authentication, but evidence is dated and affected-version details are incomplete. Prioritize internet-facing MercuryS SMTP first. Mitigation focus: Identify any Mercury Mail Transport System deployments running MercuryS SMTP.; Check vendor guidance and release history for fixed or unaffected versions.; Restrict MercuryS SMTP access to trusted networks where possible..

Prepared

Jun 29, 2026, 03:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.