Skip to main content

Exim CVE-2026-94055

| EUVDEUVD-2026-83613 LOW
Use After Free (CWE-416)
2026-09-19 mitre GHSA-jpgj-v2p6-hc2c
Information Disclosure Use After Free Memory Corruption Exim
3.7
CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY
3.7 LOW
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
3.7 LOW

Network-reachable and pre-authentication (AV:N/PR:N), but AC:H because it needs the GnuTLS backend plus non-default TLS settings; use-after-free yields a crash so A:L, C/I:N.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Patch available
Sep 20, 2026 - 01:01 EUVD
Analysis Generated
Sep 19, 2026 - 23:30 vuln.today
CVE Published
Sep 19, 2026 - 22:48 cve.org
LOW 3.7

DescriptionCVE.org

Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

AnalysisAI

A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires Exim (before 4.100.1) built against the GnuTLS TLS library AND configured with certain non-default TLS settings - the flaw does not affect the OpenSSL backend or default TLS configurations. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuinely low-priority issue despite affecting an extremely widely-deployed product. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary fix is to upgrade Exim to version 4.100.1 or later, the first release in which this use-after-free is addressed; see the vendor advisory at https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html for the exact fixed build and any packaging guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Exim

View all
CVE-2017-16943 CRITICAL POC
9.8 Nov 25

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitr
CVE-2017-16944 HIGH POC
7.5 Nov 25

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial
CVE-2016-1531 HIGH POC
7.0 Apr 07

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rat
CVE-2025-26794 HIGH
7.5 Feb 21

Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN ser
CVE-2019-10149 CRITICAL POC
9.8 Jun 05

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is re
CVE-2012-5671 MEDIUM
6.8 Oct 31

Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM suppor
CVE-2022-37452 CRITICAL POC
9.8 Aug 07

Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name
CVE-2019-16928 CRITICAL POC
9.8 Sep 27

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical sev
CVE-2018-6789 CRITICAL POC
9.8 Feb 08

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVS
CVE-2020-8015 HIGH POC
7.8 Apr 02

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attacke
CVE-2022-37451 HIGH POC
7.5 Aug 06

Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_mall
CVE-2020-12783 HIGH POC
7.5 May 11

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-94055 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy