What is CVE-2010-3407?

CVE-2010-3407 is a vulnerability in IBM Lotus Domino, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2010-09-16.

Is CVE-2010-3407 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in IBM Lotus Domino

CVE-2010-3407

Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.

Vulnerability class: Buffer Overflow

Published 2010-09-16 · last modified 2026-06-16.

CVSS v2 metric

CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.

EPSS exploit prediction

EPSS: 0.415 (98.6th percentile), scored 2026-09-30.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 99th percentile — 98.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.415 · newest: 0.415 · change: 0.000

Affected products

IBM Lotus Domino — versions 8.0.2.2, 8.5.1.1, 8.0.2.4

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

rapid7/metasploit-framework

References

exchange.xforce.ibmcloud.com/vulnerabilities/61790 (vdb-entry)
www.vupen.com/english/advisories/2010/2381 (vdb-entry, Vendor Advisory)
www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/af36678d60b… (Vendor Advisory)
www.zerodayinitiative.com/advisories/ZDI-10-177/
www.securityfocus.com/bid/43219 (vdb-entry)
www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/52f9218288b… (Vendor Advisory)
secunia.com/advisories/41433 (Vendor Advisory, third-party-advisory)
labs.mwrinfosecurity.com/files/Advisories/mwri_lotus-domino-ical-stack-overflow… (Exploit)
www-10.lotus.com/ldd/r5fixlist.nsf/8d1c0550e6242b69852570c900549a74/613a204806e… (Vendor Advisory)
www-01.ibm.com/support/docview.wss (Vendor Advisory)

Frequently asked questions

What is CVE-2010-3407?: CVE-2010-3407 is a vulnerability in IBM Lotus Domino, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2010-09-16.
Is CVE-2010-3407 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.