EUVD-2026-83612
GHSA-r24f-7cqq-88w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Exim listener as trusted proxy
-
DeliverySend malformed Proxy-Protocol header
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionCorrupt process memory
-
ImpactCompromise mail server integrity
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exim must be built and configured to use PROXY protocol (the hosts_proxy option enabling Proxy-Protocol on the listening interface) - this is a non-default deployment, typically used when Exim sits behind a load balancer or reverse proxy such as HAProxy. The attacker must control, spoof, or be accepted as a proxy that Exim trusts, so that the malicious PROXY header is parsed. Limiting factors: Proxy-Protocol is off by default, the attacker must be positioned as/within the trusted-proxy path (reflected in AC:H), and only Exim versions before 4.100.1 are affected; environments not using Proxy-Protocol are not exposed. |
| Impact | This is a moderate-to-high technical severity flaw (vendor CVSS 7.0, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) in Exim, one of the most widely deployed internet MTAs. The signals are consistent but qualified: AV:N and PR:N indicate a network-reachable, pre-authentication vector, but AC:H correctly captures the significant precondition that Proxy-Protocol must be enabled AND the attacker must control (or be trusted as) the proxy that Exim accepts - this is not a default Exim configuration. The out-of-bounds write (CWE-787) yields I:H with C:L/A:L, meaning memory corruption with credible integrity impact but the vendor did not rate it as full RCE/DoS. There is no EPSS score, no CISA KEV listing, and no public POC referenced - only the upstream exim.org mailing-list disclosure - so exploitation status is: no public exploit identified at time of analysis. Bottom line: real priority for the subset of operators running Proxy-Protocol (e.g., behind HAProxy/load balancers) but the AC:H config dependency substantially narrows the exposed population, so this is not a mass-exploitation candidate on the evidence available. |
| Exploit ScenarioDerived | An organization runs Exim behind a load balancer with Proxy-Protocol enabled (hosts_proxy). An attacker who controls, spoofs, or is positioned as a trusted proxy sends a malformed PROXY protocol header that Exim mis-parses, triggering an out-of-bounds write in the receiving process. No public POC is referenced; exploitation requires the attacker to reach Exim as an accepted proxy source. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
RemediationAI
Upgrade to Exim 4.100.1 or later, the first fixed release, which corrects the out-of-bounds write in the Proxy-Protocol parsing path (vendor advisory: https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html). If an immediate upgrade is not possible, the most effective compensating control is to stop exposing the Proxy-Protocol attack surface: remove or disable the hosts_proxy option so Exim no longer parses PROXY headers - the trade-off is that Exim will then log the load balancer's address as the client address and any source-IP-based policy (relay control, rate limiting, spam scoring) will degrade, so this works best on hosts not actually sitting behind a proxy. As a secondary control, restrict network access to the SMTP listener, ideally with packet filters and TCP wrappers/firewall rules, so only the legitimate proxy or load balancer IPs can reach the port and untrusted clients cannot inject a malicious PROXY header - this still leaves spoofing/source-address weaknesses in the upstream proxy as residual risk, and it will not protect deployments where the proxy is reachable by untrusted clients. Do not rely on generic hardening as a substitute for either the upgrade or disabling hosts_proxy, since the flaw is a memory-safety defect rather than a policy misconfiguration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Exim is one of the most widely deployed internet mail transfer agents (MTAs), and the affected component is its Proxy-Protocol handling. Proxy-Protocol (originally from HAProxy) is a header preface that a load balancer or reverse proxy prepends to a connection so the backend service can recover the real client source and destination addresses; Exim exposes this via the hosts_proxy option, which must be explicitly enabled and is not part of a default configuration. The root cause is classified as CWE-787 (Out-of-bounds Write): when Exim parses a PROXY header supplied by an attacker-controlled proxy, insufficient bounds validation causes a write past the end of an allocated buffer, corrupting adjacent memory. In a process as privileged and exposed as an MTA this class of defect can destabilize the daemon and, depending on allocator layout and attacker control over the malformed header, may be leveraged toward arbitrary code execution - although the supplied assessment rates only integrity impact as High, with confidentiality and availability Low. The CPE cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:* indicates that all Exim builds below the 4.100.1 fix threshold are in scope, but actual exposure is gated on the non-default Proxy-Protocol deployment described in the assessment.
Know when Exim gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable and pre-auth (AV:N/PR:N), but AC:H because it needs non-default Proxy-Protocol plus attacker-controlled/trusted proxy positioning; OOB write gives I:H with C:L/A:L per vendor.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Executive ViewAI
Organizations running Exim mail transfer agent versions before 4.100.1 with the optional Proxy-Protocol (hosts_proxy) feature enabled face a high-severity remote memory corruption vulnerability that can compromise mail processing integrity. Because email is a critical business service, a successful exploit could undermine trust in communications and potentially provide a foothold for further attacks. No public exploit identified at time of analysis, and a vendor-released patch (Exim 4.100.1) is available and should be applied promptly.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitr
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rat
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN ser
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is re
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM suppor
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical sev
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVS
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attacke
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_mall
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass
Exploit-DB