CVE-2004-2088: Sophos Anti-Virus

Medium severity, CVSS 5.0. EPSS: 6.7% chance of exploitation in the next 30 days.

Sophos Anti-Virus 3.78 allows remote attackers to bypass virus scanning by using a qmail generated Delivery Status Notification (DSN) where the original email is not included in the bounce message.

Affected products

• Sophos Sophos Anti-Virus: version 3.4.6 only; version 3.78 only

Published 2004-02-12. Last modified 2026-06-16.