CVE-2026-94054: High severity Exim Exim vulnerability
Published Sep 19, 2026
·Updated
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Affected Software
3 affected componentsFixes available
Exim Exim<4.100.1
Exim Exim<4.100.1
debian/exim4<=4.96-15+deb12u10, <=4.98.2-1+deb13u4
4.98.2-1+deb13u54.100.1-14.100.1-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.98.2-1+deb13u5Fixed in 4.100.1-1Fixed in 4.100.1-2 - Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.100.1
Event History
Sep 19, 2026
CVE Published
via MITRE·10:46 PM
Data Sourced
via MITRE·10:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeaknessAffected Software
Sep 28, 2026
Data Sourced
via Ubuntu·01:36 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·01:37 PM
Description
Data Sourced
via Debian·01:37 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which deployments are exposed?
Exim deployments before 4.100.1 are affected when they use Proxy-Protocol with a proxy that an attacker can control.
2
Does an attacker need an account or user interaction to exploit this?
No. The supplied vector indicates network access is required, with no privileges or user interaction required; however, exploitation has high attack complexity.