CVE-2004-2677: Qwikmail Smtp

High severity, CVSS 7.5. EPSS: 6.5% chance of exploitation in the next 30 days.

Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname arguments.

Affected products

• Qwikmail Qwikmail Smtp: version 0.3 only

Published 2004-12-31. Last modified 2026-06-16.