Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled.
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
Dear Exim users,
The Exim maintainers are releasing a security fix for two security issues.
----
Identifier: EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1) Type: Directory traversal, local Component: Exim Affects: 4.88 (2017) through the current 4.99.4 release Corrected in: Exim 4.99.5 (exim-4.99.5) Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Vulnerability Details ---------------------
Using command-line arguments intended for transferring queue-name through an Exim execution chain, files outside the spool area can be accessed. This can be used for a privilege escalation.
Affected Configurations -----------------------
All Exim installations; attacker with command-line access.
Mitigations -----------
None.
Resolution ----------
Upgrade to Exim 4.99.5. The fix is on branch exim-4.99+fixes, tag exim-4.99.5, signed by Jeremy Harris <jgh146exb () wizmail org>, key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.1/
----
Identifier: EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3) Type: Command execution with alternate privilege Component: Exim Affects: 4.82 (2013) through the current 4.99.4 release Corrected in: Exim 4.99.5 (exim-4.99.5) Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Vulnerability Details ---------------------
A local user having a .forward file can use a string-expansion there. With certain Exim configurations this can be used as a privilege escalation.
Affected Configurations -----------------------
An Exim configuration with
- a redirect router implementing .forward facilities for local users - a pipe transport accessible by that router - the pipe transport having the "forcecommand" option set - the pipe transport configured to run as a privileged user
Mitigations -----------
Do not set "forcecommand" on pipe transports.
Resolution ----------
Upgrade to Exim 4.99.5. The fix is on branch exim-4.99+fixes, tag exim-4.99.5, signed by Jeremy Harris <jgh146exb () wizmail org>, key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.3/
----
Timeline --------
2026-06-22 20:11 UTC Report received 2026-06-23 11:57 UTC Fix drafted 2026-07-12 12:00 UTC GCVEs assigned by GNA 2026-07-13 19:25 UTC Advance notice sent to distros () vs openwall org 2026-07-15 11:05 UTC Fix branch and tag exim-4.99.5 pushed to exim-distros 2025-07-22 14:00 UTC Public release Jeremy Harris On behalf of the Exim Maintainers
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in stringvformat in string.c involving a long EHLO command.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in delivermessage() function in /src/deliver.c may lead to remote command execution.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
Heap-based buffer overflow in the stringvformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spooldirectory directive.
Dear Exim users,
The Exim maintainers are releasing a security fix for CVE-2026-48840.
Identifier: EXIM-Security-2026-05-19.1 (CVE-2026-48840) Type: pre-authentication information disclosure Component: Exim Affects: 4.88 (2017) through the current 4.99.3 release Corrected in: Exim 4.99.4 (exim-4.99.4) Credit: Warisjeet Singh (sin99xx)
Vulnerability Details ---------------------
proxyprotocol() declares hdr as an uninitialised stack union. For a PROXYv2 frame, the only length guard is an upper bound: the frame size must not exceed sizeof(hdr). No lower bound is checked.
A frame with address family 0x21 (TCPv6) and len=0 sets the read size to 16, causing the read loop to copy exactly 0 bytes into the union. The TCPv6 dispatch arm then unconditionally calls:
memmove(tmpaddr6.sin6addr.s6addr, hdr.v2.addr.ip6.srcaddr, 16)
copying 16 uninitialised stack bytes into tmpip6, which inetntop formats as an IPv6 address string. That string is written to senderhostaddress and emitted in the SMTP greeting banner:
250 hostname Hello probe [::68ef:38ad:ffff:0]
The same defect affects family 0x11 (TCPv4) with len < 12 (4 leaked bytes instead of 16).
The leaked bytes track ASLR entropy across daemon restarts and are confirmed to be live userspace VA pointers, making this an ASLR-defeat primitive usable as a chain component.
Fix: add minimum-length checks per address family (12 bytes for TCPv4/0x11, 36 bytes for TCPv6/0x21) before the union is accessed. Frames that fail the check are rejected with proxyfail, consistent with all other malformed-frame handling in the function.
Reported by Warisjeet Singh (sin99xx). Tested on aarch64 Linux; architecture-independent (only leaked content varies).
Affected Configurations -----------------------
Exim compiled with SUPPORTPROXY (default in Debian, Ubuntu, RHEL/Fedora packages) and hostsproxy set to a non-empty value. The attacker's source IP must match hostsproxy, or the attacker must be able to reach the port that expects a PROXY header through a host already in hostsproxy.
Mitigations -----------
- Narrow hostsproxy to the exact load-balancer IPs (not a CIDR superset). - Unset hostsproxy entirely to disable PROXY-protocol parsing on the affected listener.
Resolution ----------
Upgrade to Exim 4.99.4. The fix is on branch exim-4.99+fixes, tag exim-4.99.4, signed by Heiko Schlittermann (HS12-RIPE) <hs () schlittermann de>, key 0xDD98D92359DE9E3C2663F291697F0EDD68099F6F.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-05-19.1/
Timeline --------
2026-05-19 12:35 UTC Report received from Warisjeet Singh (sin99xx) 2026-05-19 13:26 UTC Acknowledgement sent to reporter 2026-05-19 14:06 UTC Root cause confirmed; fix drafted 2026-05-25 13:30 UTC CVE request submitted to Mitre via cveform.mitre.org 2026-05-25 17:57 UTC CVE-2026-48840 assigned by MITRE 2026-05-26 00:41 UTC Advance notice (distro-pre.txt) sent to distros () vs openwall org 2026-05-26 00:47 UTC Advance notice sent to exim-maintainers () lists exim org 2026-05-27 14:00 UTC Fix branch and tag exim-4.99.4 pushed to exim-distros 2026-05-29 14:00 UTC Public release
-- Heiko Schlittermann On behalf of the Exim Maintainers
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS closenotify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Another Exim issue dropped, and this one is worth paying attention to if you still have internet-facing mail infrastructure.
CVE-2026-45185 affects Exim 4.97 through 4.99.2, but only GnuTLS builds. The bug is in BDAT message body handling and can lead to memory corruption, with potential code execution. OpenSSL builds are not affected, and the fix is in 4.99.3. The uncomfortable part is that Exim says there are no real mitigations that resolve it, so this is basically a patch situation.
What I find interesting here is not just the bug itself. It is how often old, boring infrastructure like MTAs still ends up being a high-value attack surface.
Mail servers sit exposed, handle weird protocol edge cases, process untrusted input all day, and often run in environments where nobody wants to touch them unless mail breaks.
I was thinking, how teams here are handling Exim/Postfix/etc. in 2026.
You guys are still running your own mail stack, or has this kind of recurring MTA risk pushed you fully toward managed email infrastructure?
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
Heiko Schlittermann <hs () nodmarc schlittermann de> writes: Hello,
The Exim maintainers are releasing an important security update to address a critical vulnerability affecting certain Exim configurations.
Vulnerability Details
A remotely reachable Use-After-Free (UAF) vulnerability has been identified in Exim's BDAT (binary data transmission) body parsing path when using the GnuTLS backend. This vulnerability can lead to heap corruption and potential code execution.
Affected Versions and Configurations
This vulnerability affects Exim versions 4.97 through 4.99.x that: - Are built with GnuTLS support - Have STARTTLS and CHUNKING advertised
Recommended Action
We strongly recommend all affected users upgrade to Exim 4.99.3 or later immediately.
Obtaining the Fix
Fixed versions are available: - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) - Tarballs: https://downloads.exim.org/exim4/ (signed by me) - Please see the Exim website for detailed upgrade instructions
Additional Information
- Distros already have coordinated access to patches - Internal tracking ID: EXIM-Security-2026-05-01.1 - Full technical details will be available: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/ CVE is CVE-2026-45185. Thank you for your cooperation. And special thanks to the reporter at xbow security. Writeup at https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann
Heiko Schlittermann <hs () nodmarc schlittermann de> (Di 12 Mai 2026 16:15:03 CEST): - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) There was a typo.
Repository: https://code.exim.org/exim/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) https://code.exim.org/exim/exim/releases/tag/exim-4.99.3 (signed by me)
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) fon +49.351.8029981 - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Hello,
The Exim maintainers are releasing an important security update to address a critical vulnerability affecting certain Exim configurations.
Vulnerability Details
A remotely reachable Use-After-Free (UAF) vulnerability has been identified in Exim's BDAT (binary data transmission) body parsing path when using the GnuTLS backend. This vulnerability can lead to heap corruption and potential code execution.
Affected Versions and Configurations
This vulnerability affects Exim versions 4.97 through 4.99.x that: - Are built with GnuTLS support - Have STARTTLS and CHUNKING advertised
Recommended Action
We strongly recommend all affected users upgrade to Exim 4.99.3 or later immediately.
Obtaining the Fix
Fixed versions are available: - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) - Tarballs: https://downloads.exim.org/exim4/ (signed by me) - Please see the Exim website for detailed upgrade instructions
Additional Information
- Distros already have coordinated access to patches - Internal tracking ID: EXIM-Security-2026-05-01.1 - Full technical details will be available: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/
Thank you for your cooperation. And special thanks to the reporter at xbow security.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) fon +49.351.8029981 - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dnexpand oddity in octal printing.
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.