A vulnerability in OpenSMTPD's default install allows an attacker to execute arbitrary code with root privileges. The vulnerability is due to a lack of input validation in the SMTP protocol parser. An attacker can send a specially crafted SMTP command to the server, which will cause the parser to execute arbitrary code with root privileges. This can be used to gain access to the server and execute malicious code.