Exim
Monthly
Information disclosure in Exim before 4.100.1 allows attackers who control or can impersonate a proxy in the configured proxy_protocol_hosts set to read uninitialized stack memory when PROXY Protocol is enabled, but only in non-default deployments and with limited confidentiality impact. This is a conditional flaw requiring attacker control of a trusted proxy; stock Exim installations without Proxy-Protocol are unaffected. No public exploit code or evidence of active exploitation was identified at time of analysis.
Privilege escalation in Exim versions 4.82 through 4.99.4 permits local users with shell access to execute arbitrary commands with elevated mail delivery privileges by crafting a malicious ~/.forward file that exploits mishandled force_command logic in the pipe transport. The affected deployment window is substantial - covering a wide span of Exim releases present across Debian, Ubuntu, and other Linux distributions. No confirmed active exploitation or public exploit code has been identified at the time of analysis; SSVC rates this as non-automatable with no observed exploitation, though technical impact is assessed as total given full CIA compromise upon success.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rated high severity (CVSS 7.0). Public exploit code available and EPSS exploitation probability 56.8%.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
Uninitialized stack memory disclosure in Exim 4.88 through 4.99.3 allows remote unauthenticated attackers to read arbitrary stack memory contents by sending specially crafted short payloads to proxy-enabled SMTP listeners. The vulnerability is constrained to proxy configurations but requires no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N), making it trivially reachable against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, and a vendor-released fix is available in Exim 4.99.4.
Out-of-bounds read in Exim before 4.99.2 when UTF-8 operators are enabled allows remote unauthenticated attackers to leak sensitive information through error messages by sending email with malformed UTF-8 trailing characters in headers. The vulnerability has high attack complexity due to the requirement for UTF-8 operator enablement and specific malformed input crafting, but requires no user interaction and operates over the network on default deployments.
Out-of-bounds write in Exim before 4.99.2 SPA authentication driver allows remote attackers to crash the mail server connection or leak uninitialized heap memory when processing adversarial SPA authentication resources, affecting confidentiality and availability of the mail service.
Out-of-bounds heap write in Exim before 4.99.2 allows unauthenticated remote attackers to cause denial of service and potentially corrupt memory when the JSON lookup feature is enabled and malformed JSON is present in untrusted email headers, due to incorrect backslash escape sequence handling in the JSON operator.
Denial of service in Exim before 4.99.2 on musl libc systems allows remote attackers to crash mail server connection instances by sending malformed DNS PTR records that trigger an octal printing bug in the dn_expand function. The vulnerability requires high network complexity to exploit but results in service unavailability for affected connections. No patch version confirmation available from provided references.
Remote heap-based buffer overflow in Exim before 4.99.1 allows an unauthenticated attacker to corrupt memory when the server runs certain non-default rate-limit configurations, potentially achieving code execution or denial of service. The published CVSS is 9.8, but the independent assessment sets attack complexity to High because exploitation hinges on the non-default rate-limit setup and default installations are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis.
A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. No vendor patch available.
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN serialization features are enabled. The vulnerability allows remote attackers to inject SQL through crafted SMTP commands, potentially compromising the mail server's configuration and queued messages.
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Exim and classified as problematic.c of the component DMARC Handler. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability was found in Exim and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. Rated medium severity (CVSS 6.3). Public exploit code available and no vendor patch available.
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g.,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.0%.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.9%.
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity.
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 35.7% and no vendor patch available.
Information disclosure in Exim before 4.100.1 allows attackers who control or can impersonate a proxy in the configured proxy_protocol_hosts set to read uninitialized stack memory when PROXY Protocol is enabled, but only in non-default deployments and with limited confidentiality impact. This is a conditional flaw requiring attacker control of a trusted proxy; stock Exim installations without Proxy-Protocol are unaffected. No public exploit code or evidence of active exploitation was identified at time of analysis.
Privilege escalation in Exim versions 4.82 through 4.99.4 permits local users with shell access to execute arbitrary commands with elevated mail delivery privileges by crafting a malicious ~/.forward file that exploits mishandled force_command logic in the pipe transport. The affected deployment window is substantial - covering a wide span of Exim releases present across Debian, Ubuntu, and other Linux distributions. No confirmed active exploitation or public exploit code has been identified at the time of analysis; SSVC rates this as non-automatable with no observed exploitation, though technical impact is assessed as total given full CIA compromise upon success.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. Rated high severity (CVSS 7.0). Public exploit code available and EPSS exploitation probability 56.8%.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
Uninitialized stack memory disclosure in Exim 4.88 through 4.99.3 allows remote unauthenticated attackers to read arbitrary stack memory contents by sending specially crafted short payloads to proxy-enabled SMTP listeners. The vulnerability is constrained to proxy configurations but requires no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N), making it trivially reachable against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, and a vendor-released fix is available in Exim 4.99.4.
Out-of-bounds read in Exim before 4.99.2 when UTF-8 operators are enabled allows remote unauthenticated attackers to leak sensitive information through error messages by sending email with malformed UTF-8 trailing characters in headers. The vulnerability has high attack complexity due to the requirement for UTF-8 operator enablement and specific malformed input crafting, but requires no user interaction and operates over the network on default deployments.
Out-of-bounds write in Exim before 4.99.2 SPA authentication driver allows remote attackers to crash the mail server connection or leak uninitialized heap memory when processing adversarial SPA authentication resources, affecting confidentiality and availability of the mail service.
Out-of-bounds heap write in Exim before 4.99.2 allows unauthenticated remote attackers to cause denial of service and potentially corrupt memory when the JSON lookup feature is enabled and malformed JSON is present in untrusted email headers, due to incorrect backslash escape sequence handling in the JSON operator.
Denial of service in Exim before 4.99.2 on musl libc systems allows remote attackers to crash mail server connection instances by sending malformed DNS PTR records that trigger an octal printing bug in the dn_expand function. The vulnerability requires high network complexity to exploit but results in service unavailability for affected connections. No patch version confirmation available from provided references.
Remote heap-based buffer overflow in Exim before 4.99.1 allows an unauthenticated attacker to corrupt memory when the server runs certain non-default rate-limit configurations, potentially achieving code execution or denial of service. The published CVSS is 9.8, but the independent assessment sets attack complexity to High because exploitation hinges on the non-default rate-limit setup and default installations are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis.
A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. Rated high severity (CVSS 8.1), this vulnerability is no authentication required. No vendor patch available.
Exim mail server version 4.98 before 4.98.1 contains a remote SQL injection vulnerability when SQLite hints and ETRN serialization features are enabled. The vulnerability allows remote attackers to inject SQL through crafted SMTP commands, potentially compromising the mail server's configuration and queued messages.
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability was found in Exim and classified as problematic.c of the component DMARC Handler. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
A vulnerability was found in Exim and classified as problematic. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.
Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. Rated medium severity (CVSS 6.3). Public exploit code available and no vendor patch available.
Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g.,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.0%.
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 76.9%.
Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity.
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 35.7% and no vendor patch available.