CVE-2026-43964: Postfix before 3.8.16, 3.9 before 3.9.10, and 3.10 before 3.10.9 sometimes allows a buffer over-read and process crash via an enhanced status code that lacks text after the third number.

Overview

Severity

Low (CVSS 3.7)

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploit Status

Not Exploited

Patch Tuesday

2026-May

Released

2026-05-06

Last Updated

2026-06-04

EPSS Score

0.32% (percentile: 23.5%)

Affected Products (2)

Other

• 21306-17084
• 19749-17086

Revision History

• 2026-05-06: Information published.
• 2026-05-07: Information published.
• 2026-06-04: Information published.