CVE-2025-61962

MediumCVSS 5.9

Published: 04/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

34th percentile - higher than 34% of all known CVEs

Summary

In fetchmail before 6.5.6, the SMTP client can crash during authentication upon receiving a 334 status code in a malformed context. The issue relates to handling unexpected SMTP server responses.

Risk Assessment

A malicious or misconfigured SMTP server could cause the fetchmail client to crash, interrupting mail retrieval. This could be used to disrupt service availability.

Recommendation

Upgrade fetchmail to version 6.5.6 or later. Until then, monitor logs for unexpected SMTP response codes.

Other vulnerabilities in fetchmail

CVE-2026-94184Medium
A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while building the NTLM authenticate response. This may lead to remote code execution depending on stack-frame layout, or to authentication failure or process termination under memory hardening.

Original NVD description (English source)

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS