Exim MTA CVE-2026-94057

Requires a network-reachable Exim SMTP service before version 4.100.1 accepting connections (typical for a mail relay/MTA), and an attacker able to first trigger a rejection during DATA processing and then send precisely crafted follow-on data that desynchronizes message-boundary parsing. Exploitation is limited by high attack complexity (the crafted timing/data around a DATA-phase rejection must be reliable) and by dependence on how a downstream/receiving mail system interprets the smuggled boundary; the real-world payoff (spoofing that bypasses SPF/DKIM/DMARC) applies mainly where other systems trust this Exim host for sender authentication. No authentication is required (PR:N) and no user interaction is needed.

This is a moderate, integrity-focused issue rather than a top priority. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N, base 4.0) correctly captures the shape: network-reachable and unauthenticated (PR:N), but with high attack complexity (AC:H) because success depends on precisely crafted data injected after a rejection during DATA processing and on how a downstream/receiving system re-interprets the message boundary. Impact is limited to integrity (I:L, email spoofing/message injection) with no confidentiality or availability effect (C:N/A:N). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is 'no public exploit identified at time of analysis.' SMTP smuggling is a well-understood class publicly, which lowers the research barrier, but the AC:H mechanics and the lack of confidentiality/availability impact keep real-world urgency below the high-CVSS appliance flaws. No signals conflict: low base score, no EPSS/KEV/POC, and integrity-only impact are mutually consistent. Priority: patch to 4.100.1 as routine MTA hygiene, prioritized higher for internet-facing mail relays that other systems trust for sender authentication.

A remote unauthenticated sender connects to an internet-facing Exim relay and, after triggering a rejection during the DATA phase, injects crafted continuation data that Exim and a downstream mail system interpret differently as message boundaries. The result is a 'smuggled' message that was never legitimately sent, enabling spoofed email that can slip past SPF/DKIM/DMARC alignment checks. No public proof-of-concept is currently identified, and the crafted-timing requirement (AC:H) makes reliable exploitation non-trivial.