CVE-2008-1497: Netwin Surgemail

High severity, CVSS 9.0. EPSS: 6.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the IMAP service in NetWin SurgeMail 38k4-4 and earlier allows remote authenticated users to execute arbitrary code via long arguments to the LSUB command.

Affected products

• Netwin Surgemail: version 1.8g3 only; version 1.9b2 only; version 2.0a2 only; version 2.0c only; version 2.0e only; version 2.0g2 only; …

Published 2008-03-25. Last modified 2026-06-16.