modes.c in smail 3.2.0.120 implements signal handlers with certain unsafe library calls, which may allow attackers to execute arbitrary code via signal handler race conditions, possibly using xmalloc.
Exploitability
AV:NAC:HAu:NImpact
C:CI:CA:C7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C