CVE-2003-0161
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disab...
Affects 9 products across 4 vendors.
A vulnerability in the prescan() function of Sendmail before version 8.12.9 allows attackers to execute arbitrary code or cause a denial of service through a buffer overflow attack.
BSID: BS-2003-GLOBAL-159219-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2003-0161?
What is the CVSS score for CVE-2003-0161?
Is CVE-2003-0161 actively exploited?
How do I remediate CVE-2003-0161?
What systems are affected by CVE-2003-0161?
| CVE ID | CVE-2003-0161 |
|---|---|
| BSID | BS-2003-GLOBAL-159219-C BreachSpider Global ID |
| CVSS Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Published | 2003-04-02 |
| Last Modified | 2026-06-16 |
| ICS Relevance | 0% |
| Source | NVD |
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Source: NIST NVD / MITRE CVE Database
The vulnerability arises from improper handling of certain conversions from char to int types in the prescan() function, leading to a disabled length check and potential misinterpretation of input values as a special 'NOCHAR' control value.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Compaq | Tru64 | 4.0b 4.0d 4.0d_pk9_bl17 4.0f 4.0f_pk6_bl17 4.0f_pk7_bl18+19 more4.0g 4.0g_pk3_bl17 5.0 5.0_pk4_bl17 5.0_pk4_bl18 5.0a 5.0a_pk3_bl17 5.0f 5.1 5.1_pk3_bl17 5.1_pk4_bl18 5.1_pk5_bl19 5.1_pk6_bl20 5.1a 5.1a_pk1_bl1 5.1a_pk2_bl2 5.1a_pk3_bl3 5.1b 5.1b_pk1_bl1 |
| Hp | Hp-Ux | 10.00 10.01 10.08 10.09 10.10 10.16+10 more10.20 10.24 10.26 10.30 10.34 11.00 11.0.4 11.11 11.20 11.22 |
| Hp | Hp-Ux Series 700 | 10.20 |
| Hp | Hp-Ux Series 800 | 10.20 |
| Hp | Sis | All versions |
| Sendmail | Sendmail | 2.6 2.6.1 2.6.2 3.0 3.0.1 3.0.2+25 more3.0.3 8.9.0 8.9.1 8.9.2 8.9.3 8.10 8.10.1 8.10.2 8.11.0 8.11.1 8.11.2 8.11.3 8.11.4 8.11.5 8.11.6 8.12 8.12.0 8.12.1 8.12.2 8.12.3 8.12.4 8.12.5 8.12.6 8.12.7 8.12.8 |
| Sendmail | Sendmail Switch | 2.1 2.1.1 2.1.2 2.1.3 2.1.4 2.1.5+10 more2.2 2.2.1 2.2.2 2.2.3 2.2.4 2.2.5 3.0 3.0.1 3.0.2 3.0.3 |
| Sun | Solaris | 2.4 2.5 2.5.1 2.6 7.0 8.0+1 more9.0 |
| Sun | Sunos | 5.4 5.5 5.5.1 5.7 5.8 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
Critical Severity - Know Your Exposure
A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →