VulnerabilityModified
CVE-2017-17689
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
MEDIUM 5.9EPSS 4.14%
Does this matter?
Lower severity and a low EPSS score (4.14%). Track it; it rarely justifies an emergency change on its own.
Description
The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.
- CVSS 3.0
- 5.9 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 4.14% probability · 91th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Affected
- 9folders/nine · apple/mail · bloop/airmail · emclient/emclient · flipdogsolutions/maildroid · freron/mailmate · gnome/evolution · google/gmail · horde/horde imp · ibm/notes · kde/kmail · kde/trojita · microsoft/outlook · mozilla/thunderbird · postbox-inc/postbox · r2mail2/r2mail2 · ritlabs/the bat
- Source
- cve@mitre.org
EPSS moved from 4.1% on 22 September 2026 to 4.1% on 27 October 2026.
References
- http://www.securityfocus.com/bid/104165Third Party Advisory, VDB Entry
- https://efail.deExploit, Mitigation, Third Party Advisory
- https://news.ycombinator.com/item?id=17066419Issue Tracking, Third Party Advisory
- https://pastebin.com/gNCc8aYmThird Party Advisory
- https://twitter.com/matthew_d_green/status/996371541591019520Third Party Advisory
- https://www.synology.com/support/security/Synology_SA_18_22Third Party Advisory
- http://www.securityfocus.com/bid/104165Third Party Advisory, VDB Entry
- https://efail.deExploit, Mitigation, Third Party Advisory
- https://news.ycombinator.com/item?id=17066419Issue Tracking, Third Party Advisory
- https://pastebin.com/gNCc8aYmThird Party Advisory
- https://twitter.com/matthew_d_green/status/996371541591019520Third Party Advisory
- https://www.synology.com/support/security/Synology_SA_18_22Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.