Tabs Mail Carrier 2.5.1 contains a buffer overflow that is triggered by a specially crafted MAIL FROM SMTP command. The vulnerability allows a remote attacker to overwrite the EIP register and execute arbitrary code, effectively granting full control of the system. This weakness is associated with CWE‑787 (Buffer Overflow).

The affected product is Tabs Mail Carrier, version 2.5.1, distributed by Tabs:Mail Carrier. Only this specific version is mentioned as vulnerable; earlier or later releases are not listed as impacted.

The CVSS score of 9.3 places the vulnerability in the High range, indicating severe potential damage. The EPSS score of less than 1% suggests that exploitation is currently unlikely to be widespread, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by connecting to the SMTP service on port 25 from any network source and sending a malicious MAIL FROM packet that overflows the buffer.