CVE-2019-25646

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Tabs Mail Carrier 2.5.1 contains a buffer overflow vulnerability in the MAIL FROM SMTP command that allows remote attackers to execute arbitrary code by sending a crafted MAIL FROM parameter. Attackers can connect to the SMTP service on port 25 and send a malicious MAIL FROM command with an oversized buffer to overwrite the EIP register and execute a bind shell payload.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Tabs	Mail Carrier	2.5.1

References

https://www.exploit-db.com/exploits/46547Exploit, Third Party Advisory, VDB Entry
https://www.vulncheck.com/advisories/tabs-mail-carrier-buffer-overflow-via-mail-fromThird Party Advisory

Timeline

Published: Mar 24, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-256478.8PhreeBooks ERP 5.2.3 contains a remote code execution vulnerability in the image manager that allows authenticated attackers to upload and e CVE-2019-256486.2MyVideoConverter Pro 3.14 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an exce CVE-2019-256495.5River Past Audio Converter 7.7.16 contains a local buffer overflow vulnerability in the activation code field that allows local attackers to CVE-2019-25657.5Vulnerability in the JD Edwards World Technical Foundation component of Oracle JD Edwards Products (subcomponent: Service Enablement). Suppo CVE-2019-256508.4River Past CamDo 3.7.6 contains a structured exception handler (SEH) buffer overflow vulnerability that allows local attackers to execute ar CVE-2019-256518.3Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior CVE-2019-256527.5UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that a CVE-2019-256535.5Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an e CVE-2019-256547.5Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to crash the service by supplying an excessively lon CVE-2019-256555.5Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by sup CVE-2019-256568.4R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structure CVE-2019-256575.5AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively