This has been out a few weeks now, but it's still a reasonably good explanation of how the last sendmail bug works.

Sendmail <= 8.12.8 prescan vulnerability analysis