CVE-2017-17689

5.9 mediumEPSS 4.1%

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

Severity

CVSS 3.0

5.9 medium

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 4.1% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
Published: 2018-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

9folders:nine
apple:mail
bloop:airmail
emclient:emclient
flipdogsolutions:maildroid
freron:mailmate
gnome:evolution
google:gmail
horde:horde_imp
ibm:notes
kde:kmail
kde:trojita
microsoft:outlook
mozilla:thunderbird
postbox-inc:postbox
r2mail2:r2mail2
ritlabs:the_bat

References

http://www.securityfocus.com/bid/104165
https://efail.de
https://news.ycombinator.com/item?id=17066419
https://pastebin.com/gNCc8aYm
https://twitter.com/matthew_d_green/status/996371541591019520

Check your stack JSON