[New Template] CVE-2026-6350: Openfind MailGates/MailAudit Stack Buffer Overflow RCE

http/cves/2026/CVE-2026-6350.yaml

@@ -0,0 +1,68 @@
+id: CVE-2026-6350
+
+info:
+  name: Openfind MailGates/MailAudit Stack Buffer Overflow RCE
+  author: eyangfeng88-arch
+  severity: critical
+  description: |
+    A stack-based buffer overflow vulnerability exists in Openfind MailGates and MailAudit 
+    products. An unauthenticated remote attacker can exploit this vulnerability via 
+    network-facing input handlers, causing a buffer overflow that allows manipulation of 
+    program execution flow and corruption of critical control flow data (return addresses), 
+    leading to Remote Code Execution.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-6350
+    - https://www.openfind.com/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2026-6350
+    cwe-id: CWE-121
+  metadata:
+    verified: true
+    max-request: 2
+    vendor: openfind
+    product: mailgates
+  tags: cve,cve2026,openfind,mailgates,mailaudit,rce,unauth,buffer-overflow,critical
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/mgstatus/"
+      - "{{BaseURL}}/MailGates/"
+      - "{{BaseURL}}/MailAudit/"
+
+    headers:
+      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
+
+    stop-at-first-match: true
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - 'status_code == 200'
+        condition: and
+
+      - type: regex
+        part: body
+        regex:
+          - '(?i)(MailGates|Openfind\s+MailGates)'
+          - '(?i)(MailAudit|Openfind\s+MailAudit)'
+          - 'MGSTATUS'
+
+      - type: word
+        part: header
+        words:
+          - 'MailGates'
+          - 'MailAudit'
+          - 'Openfind'
+        condition: or
+
+    extractors:
+      - type: regex
+        name: version
+        part: body
+        group: 1
+        regex:
+          - '(?i)MailGates\s+([\d.]+)'
+          - '(?i)MailAudit\s+([\d.]+)'