Remote heap-based buffer overflow in Exim before 4.99.1 allows an unauthenticated attacker to corrupt memory when the server runs certain non-default rate-limit configurations, potentially achieving code execution or denial of service. The published CVSS is 9.8, but the independent assessment sets attack complexity to High because exploitation hinges on the non-default rate-limit setup and default installations are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Buffer Overflow
Heap Overflow
Red Hat
Exim
NVD
CVSS 3.1
9.8
EPSS
0.5%