CVE-2010-20119

published 2025-08-21

CVE-2010-20119: CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls…

Priority P2 59 high 8.6 CVSS 4.0

AV N AC L AT N PR N UI A VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll and AOSMTP.dll ActiveX controls, specifically within the AddAttachments() method. This method fails to properly validate the length of input strings, allowing data to exceed the bounds of a fixed-size stack buffer. When invoked with an overly long string, the control can corrupt adjacent memory structures, including exception handlers, leading to potential control flow disruption.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
communicrypt_software	communicrypt_mail	<= 1.16	—

Detection & IOCs extracted from sources · hover to see the quote

filename ANSMTP.dll↗

filename AOSMTP.dll↗

command AddAttachments()↗

• → Monitor for browser processes instantiating ANSMTP.dll or AOSMTP.dll ActiveX controls, which are the vulnerable components exploited in this CVE. ↗
• → Detect calls to the AddAttachments() method on the affected ActiveX controls with abnormally long string arguments, which is the specific attack vector for this vulnerability. ↗
• → Look for stack-based buffer overflow indicators such as corruption of exception handler records (SEH chain overwrite) following invocation of AddAttachments() in the context of ANSMTP.dll or AOSMTP.dll. ↗

• · The vulnerability affects CommuniCrypt Mail versions up to and including 1.16 only; later versions are not confirmed affected. ↗
• · Both ANSMTP.dll and AOSMTP.dll are independently vulnerable; detection and remediation must cover both ActiveX controls. ↗
• · This is a browser-delivered exploit (drive-by), meaning exploitation occurs via a web browser instantiating the ActiveX control, not through direct host-based execution. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-121