CVE-2011-1720

CVE-2011-1720 describes a heap memory corruption vulnerability in the Postfix SMTP server, affecting versions before 2.5.13, 2.6.10, 2.7.4, and 2.8.3, when specific Cyrus SASL authentication methods are enabled. An attacker can trigger this by sending an invalid AUTH command followed by a valid one, leading to a denial of service (daemon crash) or potentially arbitrary code execution. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring moderate attack complexity but allowing remote exploitation without authentication. While the EPSS score indicates a higher-than-average probability of exploitation, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.