CVE-2026-94055: Use After Free
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exim4to a version that resolves this vulnerability.Fixed in 4.96-15+deb12u10Fixed in 4.98.2-1+deb13u4Fixed in 4.98.2-1+deb13u5Fixed in 4.100.1-1Fixed in 4.100.1-2 - Upgrade
Upgrade
Eximto a version that resolves this vulnerability.Fixed in 4.100.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are Exim versions before 4.100.1 that use GnuTLS with certain non-default TLS settings. The provided information does not identify the specific settings.
Can this be exploited remotely without authentication or user interaction?
The vector is network-based, and the CVSS data indicates no privileges or user interaction are required. Exploitation is rated high complexity.
What is the expected impact?
The stated impact is limited to availability; confidentiality and integrity impacts are listed as none. The CVSS score is 3.7 (low).
What should be prioritized for remediation?
Upgrade affected Exim installations to 4.100.1 or later. Prioritize systems using GnuTLS and the applicable non-default TLS configuration.