Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS closenotify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Heap-based buffer overflow in the stringvformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in stringvformat in string.c involving a long EHLO command.
The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in delivermessage() function in /src/deliver.c may lead to remote command execution.
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: openSUSE Factory exim versions prior to 4.93.0.4-3.1.
Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled.
Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spooldirectory directive.
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dnexpand oddity in octal printing.
The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.
The receivemsg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdatgetc function.
Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages.
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.
Dan Rosenberg reported that when exim is used with a world-writable mail directory, with the sticky-bit set, local users could create hard-links to other non-root users' files in the mailbox storage directory, causing files to be overwritten upon mail delivery. This could be used to create a denial of service condition or potentially escalate privileges to those of targeted users.
Further information is available from the upstream bug report [1] and this has been fixed upstream in exim 4.72 [2].
[1] http://bugs.exim.org/showbug.cgi?id=988 [2] http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.24&r2=1.25
The /var/spool/mail directory on Red Hat Enterprise Linux and Fedora is mode 0755 and owned root:mail. As a result, this is not exploitable by default.
Dan Rosenberg reported that when MBX locking is enabled in exim, local users could exploit a race condition to change permissions of other non-root users' files. This could lead to a denial of service, to create new files owned by other users in unauthorized locations, or to possibly escalate privileges.
Further information is available from the upstream bug report [1] and this has been fixed upstream in exim 4.72 [2].
[1] http://bugs.exim.org/showbug.cgi?id=989 [2] http://vcs.exim.org/viewvc/exim/exim-src/src/transports/appendfile.c?r1=1.25&r2=1.26
While exim is built to support the MBX format, it is not the default for local mail delivery (Unix mailbox support is the default). This will only affect users that use the "mbxformat" option in the appendfile transport.
Dear Exim users,
we got reported two possible (related) vulnerabilities in the latest 4.99 release. From the original report:
,--- | In vulnerable configurations, a remote, unauthenticated attacker can | achieve heap corruption. I was unable to develop an end-to-end exploit | chain for remote code execution, but it may be possible with further | work. ---
We do not publish any further details yet, until the fix goes public.
While we do not support older versions, please note, that 4.98.1 is not affected. Other versions might or might not be subject to the same attack vector.
2025-11-22: we received a report to security () exim org 2025-11-25: acknowledged the report to the reporter 2025-12-10: this notification
~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers) ~2025-12-18: publish the fix via the default repo (accessible for the public)
Once the fixes passed internal testing, we'll update the schedule and send another notification about the coordinated release date(s) for distros and the public.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Update: Coordinated release date
Heiko Schlittermann <hs () nodmarc schlittermann de> (Mi 10 Dez 2025 13:51:13 CET): … ~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers) ~2025-12-18: publish the fix via the default repo (accessible for the public)
Once the fixes passed internal testing, we'll update the schedule and send another notification about the coordinated release date(s) for distros and the public. Coordinated Release Date: 2025-12-18 15:00 UTC. Repo-URL: https://code.exim.org/exim/exim Tag: exim-4.99.1 (on branch exim-4.99+fixes)
To allow distros to prepare the packages: starting from 2025-12-15 15:00 UTC you can git-pull the 4.99.1 release via ssh://git () code exim org/exim/exim-distros (The repo is accessible already, so you can test whether you have access.)
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Update: We got assigned CVE-2025-67896
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
According to our previous CRD announcement we released Exim 4.99.1 on 2025-12-17 at 15:00 UTC.
Credits to Andrew Fasano <andrew.fasano () nist gov>, for pointing out the issue.
His original report can be found here: https://code.exim.org/exim/exim/src/commit/d46a6727798fc48d1756190a6d46d19216348c25/doc/doc-txt/exim-security-2025-12-09.1/report.txt
Short version: Exim configurations using SQLite lookups or using SQLite hint dbs where vulnerable to SQL injection attacks, which could lead to heap corruption. Distro Exim packages usually do not use SQLite hint dbs (It is a build time option. Grep the output of exim -bV for "Hints DB".) But many packages allow SQLite lookups in the runtime config (Grep the output of exim -bV for "Lookups".)
The original release announcement, as sent to exim-announce () lists exim org: --------------------------------------------------------------------------
Dear Exim users and maintainers,
we are pleased to announce the availability of release 4.99.1 of Exim.
This is a security release. It fixes CVE-2025-67896 (aka EXIM-Security-2025-12-09.1), which was introduced with 4.99. Older Exim versions may or may not be vulnerable and are not activly maintained anymore by the Exim maintainers. (To the best of our knowledge, 4.98.2¹ should be safe.)
Configurations using SQlite for lookups and hintdb were vulnerable. Details: https://code.exim.org/exim/exim/src/branch/exim-4.99+fixes/doc/doc-txt/exim-security-2025-12-09.1/report.txt
Exim 4.99.1 is available:
as tarball https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
directly from Git: https://code.exim.org/exim/exim tag: exim-4.99.1
The signatures on the release tarballs and Git tag should be
The release files are signed by key DD98D92359DE9E3C2663F291697F0EDD680= 99F6F "Heiko Schlittermann (Dresden) <hs () schlittermann de>" aka "Heiko Schlittermann (Exim MTA Maintainer) <heiko () exim org>"
¹) The original announcement mentioned a wrong version number.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Bernard helpfully notified distros of this upcoming security release on April 24 and then of the release itself on April 29, but unfortunately did not bring this to oss-security as expected - so I am doing it now, delayed by one day.
This was also sent to the public exim-announce list yesterday:
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
but it isn't prominently visible on the Exim website now. I tried clicking the Security link in the navigation on top, but this merely opened a directory listing with some text files and subdirectories in there, with all file timestamps showing as 30-Apr-2026 10:29 and so nothing clearly standing out as new. Looks like something to improve.
----- Forwarded message from Bernard Quatermass <bernardq () exim org> -----
From: Bernard Quatermass <bernardq () exim org> To: "Distros @ oss-security openwall" <distros () vs openwall org> Subject: Re: [vs-plain] EXIM-Security-2026-04-24 CC: "security () exim org" <security () exim org> Date: Wed, 29 Apr 2026 13:19:42 +0100
we are pleased to announce the availability of release 4.99.2 of Exim.
This is a security release.
It fixes the following vulnerabilities.
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing it is possible to crash the connection instance when malformed DNS data is present in PTR records.
CVE-2026-40685 Possible OOB read/write on corrupt JSON in header
configurations using json operators on invalid externally-provided input could trigger heap corruption.
CVE-2026-40686 Possible OOB read with large UTF8 trailing characters
configurations using utf8 operators on malformed utf8 in headers could trigger OOB reads and might trigger some data leak if error messages are required for subsequent emails in the current connection and similar malformed headers are present.
CVE-2026-40687 Possible OOB read/write with SPA authenticator
in configurations using the SPA authentication driver to a hostile/compromised external SPA/NTLM connnection it is possible to trigger an OOB read/write and crash the connection instance or possibly leak heap data to the instance.
Older Exim versions may or may not be vulnerable but are not actively maintained.
We would like to thank the thousands of unnamed and uncredited authors whose works were ingested into the slopbots to "assist" in the reports for these vulnerabilities.
Exim 4.99.2 is available:
as tarball https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
directly from Git: https://code.exim.org/exim/exim tag: exim-4.99.2
The signatures on the release tarballs should be
key ID 0xBCE58C8CE41F32DF Email: jgh () exim org
-- Bernard Quatermass
----- End forwarded message -----