Security Advisory

CVE-2026-57228: Suricata SMTP MIME Quoted-Printable Decoder Heap OOB Read

Last updated:
  • CVE-2026-57228

CVE-2026-57228 is a crash-causing out-of-bounds heap read in Suricata's SMTP MIME quoted-printable decoder, exploitable by sending crafted SMTP traffic with an escape sequence deliberately split across TCP chunks so the following chunk is exactly one byte, which takes down the network intrusion-detection/prevention engine wherever that specific MIME decoding option is enabled.

Vulnerability summary

9.1

Critical

0.4%

EPSS score (FIRST)

No

CISA KEV catalog

2026-09-18

Published

Vulnerability ID: CVE-2026-57228 · Source: NVD

Affected components

ComponentCPEVersion range
Suricata (OISF)cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*7.0.13 through 7.0.16 (fixed in 7.0.17)

What this means

CVE-2026-57228 (CWE-125, Out-of-bounds Read) affects Suricata, the Open Information Security Foundation's (OISF) open-source network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine widely deployed as a passive or inline sensor on OT, enterprise and ISP networks. NVD's description states: "the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled" (NVD), affecting versions 7.0.13 through 7.0.16 and fixed in 7.0.17.

NVD assigns a Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H — network-reachable, low complexity, no privileges or interaction, full confidentiality and availability impact with no integrity impact. GitHub's own CNA submission scores the same flaw lower, as a Secondary metric of 8.2 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, differing mainly on confidentiality impact (low vs. NVD's high) (NVD CVE record).

The OISF/Suricata GitHub Security Advisory GHSA-qxm4-q7vx-7xj4, titled "smtp/mime: heap out-of-bounds read quoted-printable decoder," confirms the affected range (>=7.0.13, <7.0.17), the fix in 7.0.17, and documents a configuration-level mitigation for operators who cannot upgrade immediately: setting app-layer.protocols.smtp.mime.decode-quoted-printable: no in suricata.yaml disables the vulnerable decoder path. The advisory credits Trail of Bits, working in collaboration with Anthropic, for finding the issue (GitHub Security Advisory GHSA-qxm4-q7vx-7xj4).

Because Suricata is frequently deployed as the detection engine behind commercial and open-source network/OT monitoring appliances, a crash here can degrade or disable traffic visibility on a monitored network segment for as long as the sensor is down and restarting — a Suricata outage during an active attack is a materially different risk than a crash on an idle sensor.

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00423 (36.58th percentile) (FIRST EPSS). CVE-2026-57228 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Deployments running Suricata 7.0.13 through 7.0.16 with decode-quoted-printable MIME decoding enabled should upgrade to 7.0.17, or disable that specific decoder option as an interim mitigation.

How to fix this class of issueThis advisory does not name a weakness class we have a dedicated guide for yet. The fix is usually the vendor patch or firmware update referenced above — our guide below covers how to plan and verify that: NIST SP 800-40 Rev. 4: enterprise patch management planning, explained.

Evidence

  • Suricata's SMTP MIME quoted-printable decoder (src/util-decode-mime.c) in versions 7.0.13-7.0.16 reads one byte past a heap buffer when an escape sequence is split across traffic chunks ending in a single-byte chunk, crashing the engine when decode-quoted-printable MIME decoding is enabled; fixed in 7.0.17. — NVD
  • NVD Primary CVSS v3.1 base score is 9.1 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H); GitHub's own CNA submission scores it lower as Secondary 8.2 high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). — NVD
  • GitHub Security Advisory GHSA-qxm4-q7vx-7xj4 confirms the affected range and 7.0.17 fix, documents the suricata.yaml mitigation (app-layer.protocols.smtp.mime.decode-quoted-printable: no), and credits Trail of Bits working with Anthropic. — GitHub Security Advisory
  • EPSS score is 0.00423 (36.58th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2026-58016: GLib D-Bus Introspection Parser Out-of-Bounds ReadCVE-2026-58016: NVD-Analyzed integer-underflow denial-of-service in GLib's D-Bus introspection XML parser (gio/gdbusintrospection.c). NVD Primary CVSS 9.1, patched by Red Hat across dozens of products, not on CISA KEV.CVE-2026-58704: Google Pixel Cellular Modem Privilege Escalation (KEV)CISA KEVCVE-2026-58704: KEV permission-bypass flaw in the cellular modem of Google Pixel devices lets a radio-proximate attacker escalate privileges; under limited targeted exploitation. NVD, Android bulletin, CISA KEV, EPSS.CVE-2026-59241: Siemens WinCC Privilege Escalation (pending)CVE-2026-59241: NVD-pending database privilege-escalation flaw in Siemens SIMATIC WinCC lets an authenticated user run commands on the host system.

Sources

  1. NVD
  2. GitHub Security Advisory GHSA-qxm4-q7vx-7xj4
  3. FIRST EPSS