OpenSMTPD mta_io Out Of Bounds Read Command Injection

An out-of-bounds read vulnerability exists in OpenSMTPD versions before 6.6.4 due to a logical flaw, causing a server to read multi-line error messages. The attacker-controlled message error may contain directives that get stored in an envelope file, then executed by the vulnerable server. An attacker may obtain command execution or escalate privileges by either causing a vulnerable server to bounce a message to a malicious server (c2s) or by sending an email from the vulnerable host (s2c). This strike illustrates the second scenario where the vulnerable server, that acts as the client, connects to an attacker-controlled one.