CVE-2003-0143: Qualcomm Qpopper

High severity, CVSS 10.0. EPSS: 8.6% chance of exploitation in the next 30 days.

The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Affected products

• Qualcomm Qpopper: version 4.0.1 only; version 4.0.2 only; version 4.0.3 only; version 4.0.4 only

Published 2003-03-18. Last modified 2026-06-16.