Exim CVE-2026-94056

Requires that Exim be configured to use PROXY Protocol (i.e. proxy_protocol_hosts set so Exim trusts a fronting proxy/load balancer) AND that the attacker control or successfully impersonate a host in that trusted proxy set. This is a non-default deployment mode: stock Exim installations without Proxy-Protocol enabled are not exposed. The 'attacker-controlled proxy' requirement is the primary limiting factor - an attacker with no position in the proxy trust path cannot trigger it, which is why complexity is high despite the network vector and lack of authentication to Exim itself.

This is a genuine but conditional information-disclosure flaw, not a top-tier priority. The vendor CVSS of 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L) leans high largely because of C:H and a scope change (S:C), both of which are arguable: a CWE-908 read of 'certain uninitialized data from stack memory' is bounded and non-deterministic, so C:L is more defensible than C:H, and an in-process memory read does not clearly cross a security scope, making S:U more appropriate than S:C. The AC:H rating is well-justified - exploitation requires both that Proxy-Protocol be enabled AND that the attacker control (or spoof) a trusted proxy host, a meaningful pair of preconditions. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so there is no signal of widespread or automated exploitation. Net: a real bug worth patching on Proxy-Protocol-enabled mail infrastructure, but real-world risk is moderate and limited by the non-default configuration, not the network-reachable high-CVSS headline.

An organization runs Exim behind a load balancer with Proxy-Protocol enabled and trusts the proxy source. An attacker who controls or can impersonate that trusted proxy sends a crafted Proxy-Protocol header/handshake that causes Exim to return or act on uninitialized stack memory, leaking fragments of process memory that may contain remnants of prior connections or sensitive data. No public exploit code is identified at time of analysis, and success depends on the attacker having a foothold in the proxy trust path.