EUVD-2026-48479
GHSA-mffw-2crm-m32h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires low-privileged local shell account to write .forward file; no interaction or elevated auth needed; full CIA impact on privilege escalation to mail delivery context.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
AnalysisAI
Privilege escalation in Exim versions 4.82 through 4.99.4 permits local users with shell access to execute arbitrary commands with elevated mail delivery privileges by crafting a malicious ~/.forward file that exploits mishandled force_command logic in the pipe transport. The affected deployment window is substantial - covering a wide span of Exim releases present across Debian, Ubuntu, and other Linux distributions. No confirmed active exploitation or public exploit code has been identified at the time of analysis; SSVC rates this as non-automatable with no observed exploitation, though technical impact is assessed as total given full CIA compromise upon success.
Technical ContextAI
Exim is a Unix/Linux mail transfer agent (MTA) identified by CPE cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*. The vulnerability lies in Exim's .forward file processing mechanism, which allows local users to define mail forwarding rules - including piping mail to shell commands via pipe transports. The force_command directive in a pipe transport configuration is intended to override any user-specified command in .forward files with a fixed, administrator-defined command, providing a security boundary. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) identifies the root cause: the mishandling of force_command allows a user-controlled .forward file to influence command execution in a context that should be restricted to administrator-defined commands only. This enables escalation from local user privileges to those of the Exim mail delivery process, which typically runs with elevated credentials (mail group, setuid, or root depending on system configuration).
RemediationAI
Upgrade Exim to version 4.99.5 or later, the vendor-confirmed fixed release that corrects force_command mishandling in the pipe transport. The upstream disclosure is available via the oss-security mailing list (https://openwall.com/lists/oss-security/2026/07/22/9) and tracked as EUVD-2026-48479. If an immediate upgrade is not feasible, administrators should restrict or disable pipe transport delivery in Exim's configuration: removing pipe transport definitions or setting 'allow_filter = false' for local delivery routers prevents untrusted .forward pipe directives from being processed. Disabling .forward file inclusion entirely for non-trusted accounts eliminates the attack surface at the cost of removing user-level mail forwarding functionality. These workarounds address exploitability but do not fix the underlying logic error; upgrading to 4.99.5 remains the definitive remediation.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitr
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rat
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN ser
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is re
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM suppor
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical sev
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVS
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attacke
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_mall
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass
Same technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today