CVE-2014-7844: BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.

Security readout for executives and security teams

BSD mailx versions 8.1.2 and earlier can let a remote attacker run commands by sending or supplying a specially crafted email address. The sources do not report active exploitation, but the impact is serious where vulnerable mailx is installed and reachable through automated mail handling. Exposure is most likely on legacy Unix or Linux systems with BSD mailx or bsd-mailx packages at 8.1.2 or earlier, especially where scripts, services, or mail-processing paths pass untrusted email addresses into mailx. Prioritize remediation on internet-facing, mail-processing, and automation-heavy systems. The vulnerability is old, but command execution through a common mail utility creates meaningful business risk on unmaintained hosts. Mitigation focus: Upgrade affected mailx packages using applicable vendor security advisories.; Check vendor guidance for fixed package versions and supported backports.; Remove unused BSD mailx or bsd-mailx packages from servers and images..

Prepared

Jun 6, 2026, 03:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.