Exim CVE-2025-67896

Exploitation requires the target Exim server (version before 4.99.1) to be running with certain NON-DEFAULT rate-limit configurations - i.e., the ratelimit ACL feature must be enabled in a way that causes stored rate-limit database records to be read and cast directly into internal structures without validation; default installations are not stated to be affected. Given PR:N/UI:N in the published vector, no authentication or user interaction is needed once that configuration is present, and the attacker interacts remotely over SMTP. The primary LIMITING factor is this configuration dependency: servers using default rate-limiting (or none) are not exposed, which narrows the realistic attack surface well below what the 9.8 score alone implies.

The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which on its face signals a remote, unauthenticated heap overflow with full RCE-grade impact in a network-facing mail server. However, the description qualifies the flaw as reachable only 'with certain non-default rate-limit configurations,' which materially contradicts the AC:L assumption baked into the published score - the NVD/MITRE vector does not account for the non-default configuration dependency. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input: exploitation status is therefore 'no public exploit identified at time of analysis.' The absence of KEV and the explicit non-default-config gate together suggest this is NOT yet a mass-exploitation priority despite the 9.8, and is better characterized as a high-ceiling but config-gated issue; real-world exposure depends entirely on how many Exim deployments actually enable the affected ratelimit configuration. CONFLICT TO VERIFY: published vector says AC:L but the description's 'certain non-default rate-limit configurations' implies a specialized precondition - in my independent assessment this lowers the effective score. Priority is high for any organization that has confirmed the non-default ratelimit feature in use, and medium otherwise pending config audit.

A remote attacker sends crafted SMTP traffic to an internet-facing Exim server that has been configured with the specific non-default rate-limit settings, causing poisoned database records to be cast directly into internal structures and triggering a heap-based buffer overflow in the Exim process. Because the Exim daemon typically runs with elevated privileges, a successful overflow can lead to remote code execution on the mail host. No public exploit code was identified in the provided data, so weaponization effort would currently fall on the attacker.