A buffer over-read can occur when Postfix processes an enhanced status code that contains only two numeric components and omits the required textual component after the third number. The over-read leads to an application crash, which denies the mail transfer agent from accepting or routing further messages. The weakness corresponds to CWE‑193, a sign extension or integer conversion error, and does not provide remote code execution or data disclosure capabilities.

Postfix versions prior to 3.8.16, 3.9.10, and 3.10.9 are affected. These include the main distribution packages for all supported operating systems where the older Postfix releases are installed.

The CVSS score of 3.7 marks this vulnerability as low to moderate risk. EPSS is not available, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote; a malicious actor can trigger the crash by sending a specially crafted SMTP message containing an enhanced status code lacking the third textual component. The vulnerability could be exploited by anyone with the ability to inject such a message into the server’s processing queue, potentially leading to service interruption for affected mail systems.