CVE-2009-1647: Heap-based buffer overflow in popcorn.exe in Ultrafunk Popcorn 1.87 allows remote POP3 servers to cause a d...

Security readout for executives and security teams

CVE-2009-1647 affects Ultrafunk Popcorn 1.87, an old POP3 email client. A malicious or compromised POP3 server can send an oversized success response that crashes the application. The sources describe denial of service, not confirmed data theft or code execution. Exposure is likely limited to endpoints still running Ultrafunk Popcorn 1.87 and configured to retrieve mail over POP3. Risk depends on whether users connect to untrusted, spoofed, or compromised POP3 servers. Treat as a legacy-software cleanup item unless Popcorn 1.87 is still in production. If present, prioritize replacement because public exploit information exists and the software is obsolete. Mitigation focus: Inventory endpoints for Ultrafunk Popcorn 1.87 or popcorn.exe.; Retire or replace the legacy POP3 client where found.; Check vendor or archived advisory guidance for any available update..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.