PatchTheCVECVE-2006-1255: Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attacker
CVE-2006-1255 is a high-severity flaw (CVSS 10.0) affecting mercur messaging. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) SELECT command, a different set of attack vectors and possibly a different vulnerability than CVE-2003-1177.
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 10.0 (High) |
| EPSS exploit chance | 68.8% (top 1%) |
| CISA exploited list | No |
| Published | 2006-03-19 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Mercur MailServer 5.0 - IMAP SP3 SELECT Buffer Overflow (Metasploit)
- Exploit-DB: Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (1)
- Exploit-DB: Mercur MailServer 5.0 SP3 - 'IMAP' Remote Buffer Overflow (2)
- Exploit-DB: Mercur Messaging 2005 - IMAP Login Buffer Overflow (Metasploit)
- Exploit-DB: Mercur Messaging 2005 - IMAP Remote Buffer Overflow
- Exploit-DB: Mercur Messaging 2005 < SP4 - IMAP Remote (Egghunter)
- Metasploit: Mercur v5.0 IMAP SP3 SELECT Buffer Overflow
- Metasploit: Mercur Messaging 2005 IMAP Login Buffer Overflow
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2006-1255?
mercur messaging: upgrade to newer than 2005_5.0_sp3. Exact commands for each OS are on this page.
Is CVE-2006-1255 being exploited?
CVE-2006-1255 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2006-1255 affect?
CVE-2006-1255 affects mercur messaging. Severity is high (CVSS 10.0). Stack-based buffer overflow in the IMAP service in Mercur Messaging 5.0 SP3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long string to the (1) LOGIN or (2) S
How urgent is CVE-2006-1255?
Priority 65/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference
Related CVEs
- CVE-2005-1657 HIGH 7.5 DOWNGRADE Multiple directory traversal vulnerabilities in Mercur Messaging 2005 SP2 allow remote attackers to perform un
- CVE-2005-1656 MEDIUM 5.0 DOWNGRADE Mercur Messaging 2005 SP2 allows remote attackers to read the source code of .ctml files via a URL with a trai