CVE-2003-1557: Spamassassin

High severity, CVSS 7.6. EPSS: 4.6% chance of exploitation in the next 30 days.

Off-by-one buffer overflow in spamc of SpamAssassin 2.40 through 2.43, when using BSMTP mode ("-B"), allows remote attackers to execute arbitrary code via email containing headers with leading "." characters.

Affected products

• Spamassassin Spamassassin: version 2.40 only; version 2.41 only; version 2.42 only; version 2.43 only

Published 2003-12-31. Last modified 2026-06-16.