CVE-2009-0363: Barnowl

High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days.

Multiple buffer overflows in (a) BarnOwl before 1.0.5 and (b) owl 2.1.11 allow remote attackers to execute arbitrary code via vectors involving (1) a crafted zcrypt message, related to zcrypt.c; (2) a reply command on a message with a Zephyr Cc: list, related to zwrite.c; and unspecified other use of the products.

Affected products

• Barnowl Barnowl: up to and including 1.0.4.1; version 1.0.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.2.1 only; version 1.0.3 only; …
• Ktools Owl: version 2.1.11 only

Published 2009-02-17. Last modified 2026-06-16.