See how exim compares to other vendors in security performance
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Hi,
Bernard Quatermass kindly brought this Exim release pre-announcement to the distros list (thanks!), but seems to have failed to make the required oss-security posting despite of the release having been made. So I am doing it now.
What follows below is copy-paste from:
https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html
Alexander
Author: Bernard Quatermass via Exim-announce Date: 2026-09-18 14:12 +200 To: Exim Announcements, exim-users Subject: [exim] Exim Security Release - 4.100.1
Dear Exim users,
The Exim maintainers are releasing a security fix for four security issues.
GCVE-25-2026-09-50-1 GCVE-25-2026-09-51-1 GCVE-25-2026-09-55-1 GCVE-25-2026-09-56-1
----
Title: Exim Security Advisory for EXIM-Security-2026-09-12.1 / GCVE-25-2026-09-50-1 Announced: 2026-09-18 Affects: Exim 4.83 up to and including 4.100 Corrected: Exim 4.100.1
Exim Security Vulnerability: EXIM-Security-2026-09-12.1 =======================================================
Identifier: EXIM-Security-2026-09-12.1 (GCVE-25-2026-09-50-1) Area: Proxy Protocol, v1 Type: Out-of-bounds write; heap corruption Severity: High Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Timeline --------
2026-08-25 18:41 UTC Report received 2026-08-27 15:57 UTC Fix drafted 2026-09-11 18:00 UTC GCVEs assigned by GNA 2026-09-15 12:00 UTC Fix branch and tag exim-4.100.1 pushed to exim-distros 2026-09-18 12:00 UTC Public release
Vulnerability Summary ---------------------
A remote attacker can cause a read of up to about 230 bytes past the end of a heap allocation, and a single NUL byte write at the end of that read.
Affected Systems ----------------
- Exim versions from 4.83 (2014) up to and including 4.100 are affected. - The installation must be built and configured for Proxy-Protocol use. - A configured proxy must be be buggy or compromised
Mitigation ----------
(None)
Resolution ----------
The issue is resolved in Exim version 4.100.1. All users of affected versions are strongly encouraged to upgrade.
The fix properly sizes a data read.
----
Title: Exim Security Advisory for EXIM-Security-2026-09-12.3 / GCVE-25-2026-09-51-1 Announced: 2026-09-18 Affects: Exim 4.98 up to and including 4.100 Corrected: Exim 4.100.1
Exim Security Vulnerability: EXIM-Security-2026-09-12.3 =======================================================
Identifier: EXIM-Security-2026-09-12.3 (GCVE-25-2026-09-51-1) Area: gnutls, tls-on-connect Type: Use after free Severity: Low Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Timeline --------
2026-08-25 18:41 UTC Report received 2026-08-27 14:20 UTC Fix drafted 2026-09-11 18:00 UTC GCVEs assigned by GNA 2026-09-15 12:00 UTC Fix branch and tag exim-4.100.1 pushed to exim-distros 2026-09-18 12:00 UTC Public release
Vulnerability Summary ---------------------
A remote attacker can cause a use-after-free, potentially crashing a receive process.
Affected Systems ----------------
- Exim versions from 4.98 up to and including 4.100 are affected. - The installation must be built with GnuTLS 3.6.4 or later, and configured to accept TLS-on-connect. - The configuration must enable the tlsearlybannerhosts option (a non-default setting).
Mitigation ----------
- Disable the tlsearlybannerhosts feature option.
Resolution ----------
The issue is resolved in Exim version 4.100.1. Users of affected versions are encouraged to upgrade.
The fix changes the control flow to avoid the data use.
----
Title: Exim Security Advisory for EXIM-Security-2026-09-12.2 / GCVE-25-2026-09-55-1 Announced: 2026-09-18 Affects: Exim 4.83 up to and including 4.100 Corrected: Exim 4.100.1 Reporter ref: WT-2026-0149
Exim Security Vulnerability: EXIM-Security-2026-09-12.2 =======================================================
Identifier: EXIM-Security-2026-09-12.2 (GCVE-25-2026-09-55-1) Area: Proxy Protocol, v2 Type: Use of uninitialised data Severity: High Credit: McCaulay Hudson (@McCaulay) of watchTowr
Timeline --------
2026-09-08 13:48 UTC Report received 2026-09-10 14:52 UTC Fix drafted 2026-09-11 18:00 UTC GCVEs assigned by GNA 2026-09-15 12:00 UTC Fix branch and tag exim-4.100.1 pushed to exim-distros 2026-09-18 12:00 UTC Public release
Vulnerability Summary ---------------------
A remote attacker can cause a leak of stack data to be transmitted.
Affected Systems ----------------
- Exim versions from 4.83 (2014) up to and including 4.100 are affected. - The installation must be built and configured for Proxy-Protocol use. - A configured proxy must be be buggy or compromised
Mitigation ----------
(None)
Resolution ----------
The issue is resolved in Exim version 4.100.1. All users of affected versions are strongly encouraged to upgrade.
The fix repeats reads until a complete protocol header is received.
----
Title: Exim Security Advisory for EXIM-Security-2026-09-12.4 / GCVE-25-2026-09-56-1 Announced: 2026-09-18 Affects: All Exim versions up to and including 4.100 Corrected: Exim 4.100.1 Reporter ref: WT-2026-0148
Exim Security Vulnerability: EXIM-Security-2026-09-12.4 =======================================================
Identifier: EXIM-Security-2026-09-12.4 (GCVE-25-2026-09-56-1) Area: SMTP reception Type: SMTP smuggling Severity: Medium Credit: McCaulay Hudson (@McCaulay) of watchTowr
Timeline --------
2026-09-08 13:46 UTC Report received 2026-09-11 12:53 UTC Fix drafted 2026-09-11 18:00 UTC GCVEs assigned by GNA 2026-09-15 12:00 UTC Fix branch and tag exim-4.100.1 pushed to exim-distros 2026-09-18 12:00 UTC Public release
Vulnerability Summary ---------------------
A remote attacker can cause a message submission different to the one sent and logged by the sending system. The attack requires a data-phase rejection of a message which has crafted data following the rejection point.
Note hoever that the normal and configured procesing done for recived messages is applied to the "smuggled" message.
Affected Systems ----------------
- All Exim versions up to and including 4.100 are affected.
Mitigation ----------
(None)
Resolution ----------
The issue is resolved in Exim version 4.100.1. All users of affected versions are strongly encouraged to upgrade.
The fix properly identifies the end of data phase, for a rejection.
----
Downloads ---------
The new version is available from the usual locations:
- https://ftp.exim.org/pub/exim/exim4/ - https://code.exim.org/exim/exim (branch master, tag exim-4.100.1)
The release tag exim-4.100.1, signed by
key ID 0xBCE58C8CE41F32DF Email: jgh@???
SIZE(00-sha256sums.txt)= 1833 SIZE(00-sha512sums.txt)= 2985 SIZE(00-sizes.txt)= 762 SIZE(exim-4.100.1.tar.bz2)= 2184903 SIZE(exim-4.100.1.tar.gz)= 2751495 SIZE(exim-4.100.1.tar.xz)= 2007956 SIZE(exim-html-4.100.1.tar.bz2)= 652419 SIZE(exim-html-4.100.1.tar.gz)= 903609 SIZE(exim-html-4.100.1.tar.xz)= 640384 SIZE(exim-info-4.100.1.tar.bz2)= 485497 SIZE(exim-info-4.100.1.tar.gz)= 653777 SIZE(exim-info-4.100.1.tar.xz)= 487004 SIZE(exim-pdf-4.100.1.tar.bz2)= 2219741 SIZE(exim-pdf-4.100.1.tar.gz)= 2250800 SIZE(exim-pdf-4.100.1.tar.xz)= 2183016 SIZE(exim-postscript-4.100.1.tar.bz2)= 1172177 SIZE(exim-postscript-4.100.1.tar.gz)= 1572700 SIZE(exim-postscript-4.100.1.tar.xz)= 1161232 SIZE(exim-texinfo-4.100.1.tar.bz2)= 459226 SIZE(exim-texinfo-4.100.1.tar.gz)= 614517 SIZE(exim-texinfo-4.100.1.tar.xz)= 462176
SHA2-256(00-sha256sums.txt)= 64934708b587089d6019892a2fe5ad7d5cb5b2413bd78e4dbf1d66e462952a90 SHA2-256(00-sha512sums.txt)= 9b2318956abcb26a193702401713368853e9c6c4d7d4654028aa14cafb24e75c SHA2-256(00-sizes.txt)= ae4b8149277d385e3bfb20737590c71426a70aff10f7cb12188c345f30ab387b SHA2-256(exim-4.100.1.tar.bz2)= 5258d114acde46d62445328424c3cb37a0445c9228338f2e265f01b8e8615f66 SHA2-256(exim-4.100.1.tar.gz)= bc5f28d55b355939ecbf1e3ff0c7db81ed61e1fc61a1b8887b5fc922aa974075 SHA2-256(exim-4.100.1.tar.xz)= e9fb41f6724a5b136d64c9d19dbc5f26494af879a3e7e3190f91639eaa79fa0d SHA2-256(exim-html-4.100.1.tar.bz2)= 82e426dcfa5d3795b4b82f5dfe91290a4f265d17fb07c1e842a701f398751fb3 SHA2-256(exim-html-4.100.1.tar.gz)= 21af75cadbb9a93596bd5b1ac1a091d9dbff08269fd33bcd62e295c123080af3 SHA2-256(exim-html-4.100.1.tar.xz)= 04cdffd8457072557228239d55d9b9ac672e64324881601440199d0692b9da03 SHA2-256(exim-info-4.100.1.tar.bz2)= 549b6da5a75f0e0f75fd00c31822d861a6068a17018f1aff7daa12f3ce5abfbf SHA2-256(exim-info-4.100.1.tar.gz)= 05e82d1122c2bcfa24797f76c29f4eb7967b2644b621eb5ad4e79ea1019a9697 SHA2-256(exim-info-4.100.1.tar.xz)= 8ae8d645303a68988970ff62aaeae5a2d79e1cf78a26b866ab8017914d694ca4 SHA2-256(exim-pdf-4.100.1.tar.bz2)= 2c457c07905ceaa637c83890b00bcf7a1d306bf04121f4ab2732e402c655311b SHA2-256(exim-pdf-4.100.1.tar.gz)= 8ad869693b650db1e1d6af51d7bee635814ddbe1d0aaba0fae26d7aa7b0e2b46 SHA2-256(exim-pdf-4.100.1.tar.xz)= b35f9207cf918ac87bdd2fa4181fae4a4f0edf2b6caba1704b7c71f7294695af SHA2-256(exim-postscript-4.100.1.tar.bz2)= c0286d465f51366a29fe8845d030c370e9cf58edf98d055db99ab3dae2d296bd SHA2-256(exim-postscript-4.100.1.tar.gz)= e62c6a2ed947ffb01e5ab3485d5e1bbadc3ec9f153282cc91d67424db65a015b SHA2-256(exim-postscript-4.100.1.tar.xz)= 09fe756947d82a85e56a2fab2df7b0e280aba9018cd9b054a4413de39feed5e4 SHA2-256(exim-texinfo-4.100.1.tar.bz2)= 547f7e527d81eb640d94c978a1d9ae80239eb17cc9f5681ec2b8cb8d9fc599f1 SHA2-256(exim-texinfo-4.100.1.tar.gz)= 92afabbcd2f4af83ab7177a9d15c1661d82f47b189d60cadd4c319300131fb79 SHA2-256(exim-texinfo-4.100.1.tar.xz)= c09df28e9b4eb20ba34410c1ae447a47e23d730efaafe487b8743087b2f42dd3
-- Bernard Quatermass
Exim before 4.99.5 allows .forward privilege escalation because forcecommand for a pipe transport is mishandled.
Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
Dear Exim users,
The Exim maintainers are releasing a security fix for two security issues.
----
Identifier: EXIM-Security-2026-06-22.1 (GCVE-25-2026-07-45-1) Type: Directory traversal, local Component: Exim Affects: 4.88 (2017) through the current 4.99.4 release Corrected in: Exim 4.99.5 (exim-4.99.5) Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Vulnerability Details ---------------------
Using command-line arguments intended for transferring queue-name through an Exim execution chain, files outside the spool area can be accessed. This can be used for a privilege escalation.
Affected Configurations -----------------------
All Exim installations; attacker with command-line access.
Mitigations -----------
None.
Resolution ----------
Upgrade to Exim 4.99.5. The fix is on branch exim-4.99+fixes, tag exim-4.99.5, signed by Jeremy Harris <jgh146exb () wizmail org>, key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.1/
----
Identifier: EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3) Type: Command execution with alternate privilege Component: Exim Affects: 4.82 (2013) through the current 4.99.4 release Corrected in: Exim 4.99.5 (exim-4.99.5) Credit: The unnamed and uncredited authors whose works were ingested as the training corpus
Vulnerability Details ---------------------
A local user having a .forward file can use a string-expansion there. With certain Exim configurations this can be used as a privilege escalation.
Affected Configurations -----------------------
An Exim configuration with
- a redirect router implementing .forward facilities for local users - a pipe transport accessible by that router - the pipe transport having the "forcecommand" option set - the pipe transport configured to run as a privileged user
Mitigations -----------
Do not set "forcecommand" on pipe transports.
Resolution ----------
Upgrade to Exim 4.99.5. The fix is on branch exim-4.99+fixes, tag exim-4.99.5, signed by Jeremy Harris <jgh146exb () wizmail org>, key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-06-22.3/
----
Timeline --------
2026-06-22 20:11 UTC Report received 2026-06-23 11:57 UTC Fix drafted 2026-07-12 12:00 UTC GCVEs assigned by GNA 2026-07-13 19:25 UTC Advance notice sent to distros () vs openwall org 2026-07-15 11:05 UTC Fix branch and tag exim-4.99.5 pushed to exim-distros 2025-07-22 14:00 UTC Public release Jeremy Harris On behalf of the Exim Maintainers
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
Dear Exim users,
The Exim maintainers are releasing a security fix for CVE-2026-48840.
Identifier: EXIM-Security-2026-05-19.1 (CVE-2026-48840) Type: pre-authentication information disclosure Component: Exim Affects: 4.88 (2017) through the current 4.99.3 release Corrected in: Exim 4.99.4 (exim-4.99.4) Credit: Warisjeet Singh (sin99xx)
Vulnerability Details ---------------------
proxyprotocol() declares hdr as an uninitialised stack union. For a PROXYv2 frame, the only length guard is an upper bound: the frame size must not exceed sizeof(hdr). No lower bound is checked.
A frame with address family 0x21 (TCPv6) and len=0 sets the read size to 16, causing the read loop to copy exactly 0 bytes into the union. The TCPv6 dispatch arm then unconditionally calls:
memmove(tmpaddr6.sin6addr.s6addr, hdr.v2.addr.ip6.srcaddr, 16)
copying 16 uninitialised stack bytes into tmpip6, which inetntop formats as an IPv6 address string. That string is written to senderhostaddress and emitted in the SMTP greeting banner:
250 hostname Hello probe [::68ef:38ad:ffff:0]
The same defect affects family 0x11 (TCPv4) with len < 12 (4 leaked bytes instead of 16).
The leaked bytes track ASLR entropy across daemon restarts and are confirmed to be live userspace VA pointers, making this an ASLR-defeat primitive usable as a chain component.
Fix: add minimum-length checks per address family (12 bytes for TCPv4/0x11, 36 bytes for TCPv6/0x21) before the union is accessed. Frames that fail the check are rejected with proxyfail, consistent with all other malformed-frame handling in the function.
Reported by Warisjeet Singh (sin99xx). Tested on aarch64 Linux; architecture-independent (only leaked content varies).
Affected Configurations -----------------------
Exim compiled with SUPPORTPROXY (default in Debian, Ubuntu, RHEL/Fedora packages) and hostsproxy set to a non-empty value. The attacker's source IP must match hostsproxy, or the attacker must be able to reach the port that expects a PROXY header through a host already in hostsproxy.
Mitigations -----------
- Narrow hostsproxy to the exact load-balancer IPs (not a CIDR superset). - Unset hostsproxy entirely to disable PROXY-protocol parsing on the affected listener.
Resolution ----------
Upgrade to Exim 4.99.4. The fix is on branch exim-4.99+fixes, tag exim-4.99.4, signed by Heiko Schlittermann (HS12-RIPE) <hs () schlittermann de>, key 0xDD98D92359DE9E3C2663F291697F0EDD68099F6F.
Downloads ---------
https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
Advisory --------
https://www.exim.org/static/doc/security/EXIM-Security-2026-05-19.1/
Timeline --------
2026-05-19 12:35 UTC Report received from Warisjeet Singh (sin99xx) 2026-05-19 13:26 UTC Acknowledgement sent to reporter 2026-05-19 14:06 UTC Root cause confirmed; fix drafted 2026-05-25 13:30 UTC CVE request submitted to Mitre via cveform.mitre.org 2026-05-25 17:57 UTC CVE-2026-48840 assigned by MITRE 2026-05-26 00:41 UTC Advance notice (distro-pre.txt) sent to distros () vs openwall org 2026-05-26 00:47 UTC Advance notice sent to exim-maintainers () lists exim org 2026-05-27 14:00 UTC Fix branch and tag exim-4.99.4 pushed to exim-distros 2026-05-29 14:00 UTC Public release
-- Heiko Schlittermann On behalf of the Exim Maintainers
Another Exim issue dropped, and this one is worth paying attention to if you still have internet-facing mail infrastructure.
CVE-2026-45185 affects Exim 4.97 through 4.99.2, but only GnuTLS builds. The bug is in BDAT message body handling and can lead to memory corruption, with potential code execution. OpenSSL builds are not affected, and the fix is in 4.99.3. The uncomfortable part is that Exim says there are no real mitigations that resolve it, so this is basically a patch situation.
What I find interesting here is not just the bug itself. It is how often old, boring infrastructure like MTAs still ends up being a high-value attack surface.
Mail servers sit exposed, handle weird protocol edge cases, process untrusted input all day, and often run in environments where nobody wants to touch them unless mail breaks.
I was thinking, how teams here are handling Exim/Postfix/etc. in 2026.
You guys are still running your own mail stack, or has this kind of recurring MTA risk pushed you fully toward managed email infrastructure?
Heiko Schlittermann <hs () nodmarc schlittermann de> writes: Hello,
The Exim maintainers are releasing an important security update to address a critical vulnerability affecting certain Exim configurations.
Vulnerability Details
A remotely reachable Use-After-Free (UAF) vulnerability has been identified in Exim's BDAT (binary data transmission) body parsing path when using the GnuTLS backend. This vulnerability can lead to heap corruption and potential code execution.
Affected Versions and Configurations
This vulnerability affects Exim versions 4.97 through 4.99.x that: - Are built with GnuTLS support - Have STARTTLS and CHUNKING advertised
Recommended Action
We strongly recommend all affected users upgrade to Exim 4.99.3 or later immediately.
Obtaining the Fix
Fixed versions are available: - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) - Tarballs: https://downloads.exim.org/exim4/ (signed by me) - Please see the Exim website for detailed upgrade instructions
Additional Information
- Distros already have coordinated access to patches - Internal tracking ID: EXIM-Security-2026-05-01.1 - Full technical details will be available: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/ CVE is CVE-2026-45185. Thank you for your cooperation. And special thanks to the reporter at xbow security. Writeup at https://xbow.com/blog/dead-letter-cve-2026-45185-xbow-found-rce-exim Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann
Heiko Schlittermann <hs () nodmarc schlittermann de> (Di 12 Mai 2026 16:15:03 CEST): - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) There was a typo.
Repository: https://code.exim.org/exim/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) https://code.exim.org/exim/exim/releases/tag/exim-4.99.3 (signed by me)
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) fon +49.351.8029981 - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Hello,
The Exim maintainers are releasing an important security update to address a critical vulnerability affecting certain Exim configurations.
Vulnerability Details
A remotely reachable Use-After-Free (UAF) vulnerability has been identified in Exim's BDAT (binary data transmission) body parsing path when using the GnuTLS backend. This vulnerability can lead to heap corruption and potential code execution.
Affected Versions and Configurations
This vulnerability affects Exim versions 4.97 through 4.99.x that: - Are built with GnuTLS support - Have STARTTLS and CHUNKING advertised
Recommended Action
We strongly recommend all affected users upgrade to Exim 4.99.3 or later immediately.
Obtaining the Fix
Fixed versions are available: - Repository: https://code.exim.org/exim-/exim (branch: exim-4.99+fixes, tag: exim-4.99.3) (signed by me) - Tarballs: https://downloads.exim.org/exim4/ (signed by me) - Please see the Exim website for detailed upgrade instructions
Additional Information
- Distros already have coordinated access to patches - Internal tracking ID: EXIM-Security-2026-05-01.1 - Full technical details will be available: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/
Thank you for your cooperation. And special thanks to the reporter at xbow security.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) fon +49.351.8029981 - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS closenotify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
Solar Designer: From: Bernard Quatermass <bernardq () exim org> Subject: Re: [vs-plain] EXIM-Security-2026-04-24 To: "Distros @ oss-security openwall" <distros () vs openwall org> CC: "security () exim org" <security () exim org> Date: Wed, 29 Apr 2026 13:19:42 +0100 (2 days, 3 hours, 26 seconds ago)
we are pleased to announce the availability of release 4.99.2 of Exim.
This is a security release.
It fixes the following vulnerabilities.
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing it is possible to crash the connection instance when malformed DNS data is present in PTR records. I sent a note to Rich Felker (musl maintainer) regarding this.
Bernard helpfully notified distros of this upcoming security release on April 24 and then of the release itself on April 29, but unfortunately did not bring this to oss-security as expected - so I am doing it now, delayed by one day.
This was also sent to the public exim-announce list yesterday:
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
but it isn't prominently visible on the Exim website now. I tried clicking the Security link in the navigation on top, but this merely opened a directory listing with some text files and subdirectories in there, with all file timestamps showing as 30-Apr-2026 10:29 and so nothing clearly standing out as new. Looks like something to improve.
----- Forwarded message from Bernard Quatermass <bernardq () exim org> -----
From: Bernard Quatermass <bernardq () exim org> To: "Distros @ oss-security openwall" <distros () vs openwall org> Subject: Re: [vs-plain] EXIM-Security-2026-04-24 CC: "security () exim org" <security () exim org> Date: Wed, 29 Apr 2026 13:19:42 +0100
we are pleased to announce the availability of release 4.99.2 of Exim.
This is a security release.
It fixes the following vulnerabilities.
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing it is possible to crash the connection instance when malformed DNS data is present in PTR records.
CVE-2026-40685 Possible OOB read/write on corrupt JSON in header
configurations using json operators on invalid externally-provided input could trigger heap corruption.
CVE-2026-40686 Possible OOB read with large UTF8 trailing characters
configurations using utf8 operators on malformed utf8 in headers could trigger OOB reads and might trigger some data leak if error messages are required for subsequent emails in the current connection and similar malformed headers are present.
CVE-2026-40687 Possible OOB read/write with SPA authenticator
in configurations using the SPA authentication driver to a hostile/compromised external SPA/NTLM connnection it is possible to trigger an OOB read/write and crash the connection instance or possibly leak heap data to the instance.
Older Exim versions may or may not be vulnerable but are not actively maintained.
We would like to thank the thousands of unnamed and uncredited authors whose works were ingested into the slopbots to "assist" in the reports for these vulnerabilities.
Exim 4.99.2 is available:
as tarball https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
directly from Git: https://code.exim.org/exim/exim tag: exim-4.99.2
The signatures on the release tarballs should be
key ID 0xBCE58C8CE41F32DF Email: jgh () exim org
-- Bernard Quatermass
----- End forwarded message -----
In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dnexpand oddity in octal printing.
According to our previous CRD announcement we released Exim 4.99.1 on 2025-12-17 at 15:00 UTC.
Credits to Andrew Fasano <andrew.fasano () nist gov>, for pointing out the issue.
His original report can be found here: https://code.exim.org/exim/exim/src/commit/d46a6727798fc48d1756190a6d46d19216348c25/doc/doc-txt/exim-security-2025-12-09.1/report.txt
Short version: Exim configurations using SQLite lookups or using SQLite hint dbs where vulnerable to SQL injection attacks, which could lead to heap corruption. Distro Exim packages usually do not use SQLite hint dbs (It is a build time option. Grep the output of exim -bV for "Hints DB".) But many packages allow SQLite lookups in the runtime config (Grep the output of exim -bV for "Lookups".)
The original release announcement, as sent to exim-announce () lists exim org: --------------------------------------------------------------------------
Dear Exim users and maintainers,
we are pleased to announce the availability of release 4.99.1 of Exim.
This is a security release. It fixes CVE-2025-67896 (aka EXIM-Security-2025-12-09.1), which was introduced with 4.99. Older Exim versions may or may not be vulnerable and are not activly maintained anymore by the Exim maintainers. (To the best of our knowledge, 4.98.2¹ should be safe.)
Configurations using SQlite for lookups and hintdb were vulnerable. Details: https://code.exim.org/exim/exim/src/branch/exim-4.99+fixes/doc/doc-txt/exim-security-2025-12-09.1/report.txt
Exim 4.99.1 is available:
as tarball https://ftp.exim.org/pub/exim/exim4/ https://code.exim.org/exim/exim/releases
directly from Git: https://code.exim.org/exim/exim tag: exim-4.99.1
The signatures on the release tarballs and Git tag should be
The release files are signed by key DD98D92359DE9E3C2663F291697F0EDD680= 99F6F "Heiko Schlittermann (Dresden) <hs () schlittermann de>" aka "Heiko Schlittermann (Exim MTA Maintainer) <heiko () exim org>"
¹) The original announcement mentioned a wrong version number.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Update: We got assigned CVE-2025-67896
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
Update: Coordinated release date
Heiko Schlittermann <hs () nodmarc schlittermann de> (Mi 10 Dez 2025 13:51:13 CET): … ~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers) ~2025-12-18: publish the fix via the default repo (accessible for the public)
Once the fixes passed internal testing, we'll update the schedule and send another notification about the coordinated release date(s) for distros and the public. Coordinated Release Date: 2025-12-18 15:00 UTC. Repo-URL: https://code.exim.org/exim/exim Tag: exim-4.99.1 (on branch exim-4.99+fixes)
To allow distros to prepare the packages: starting from 2025-12-15 15:00 UTC you can git-pull the 4.99.1 release via ssh://git () code exim org/exim/exim-distros (The repo is accessible already, so you can test whether you have access.)
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
Dear Exim users,
we got reported two possible (related) vulnerabilities in the latest 4.99 release. From the original report:
,--- | In vulnerable configurations, a remote, unauthenticated attacker can | achieve heap corruption. I was unable to develop an end-to-end exploit | chain for remote code execution, but it may be possible with further | work. ---
We do not publish any further details yet, until the fix goes public.
While we do not support older versions, please note, that 4.98.1 is not affected. Other versions might or might not be subject to the same attack vector.
2025-11-22: we received a report to security () exim org 2025-11-25: acknowledged the report to the reporter 2025-12-10: this notification
~2025-12-15: publish the fix via the distros repo (accessible for the distro packagers) ~2025-12-18: publish the fix via the default repo (accessible for the public)
Once the fixes passed internal testing, we'll update the schedule and send another notification about the coordinated release date(s) for distros and the public.
Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -
This vulnerability allows local attackers to escalate privileges on affected installations of Exim. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-30232.
This vulnerability allows local attackers to escalate privileges on affected installations of Exim. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2025-30232.