CVE-2025-62875
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
Risk Assessment
A local user can cause a crash of the OpenSMTPD service, leading to denial of service for email.
Recommendation
Update OpenSMTPD to version 7.8.0p0-1.1 or later in openSUSE Tumbleweed. Consider restricting local access to the server.
Other vulnerabilities in OpenSMTPD
See all- CVE-2020-7247CriticalActively exploited
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
- CVE-2015-7687Critical
A use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
Original NVD description (English source)
An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to crash OpenSMTPD. This issue affects openSUSE Tumbleweed: from ? before 7.8.0p0-1.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS