EExim

Products

Exploited and recent CVEs

• CVE-2019-10149 Critical 9.0 Exploited A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution. 100.0%
• CVE-2026-94057 Medium 4.0 Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing. 0.2%
• CVE-2026-94056 High 7.5 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory. 0.2%
• CVE-2026-94055 Low 3.7 Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. 0.3%
• CVE-2026-94054 High 7.0 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. 0.3%
• CVE-2026-66141 High 7.4 Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. 0.1%
• CVE-2026-66140 High 8.4 Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled. 0.4%
• CVE-2026-48840 Medium 5.3 Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client. 0.3%
• CVE-2026-45185 Critical 9.8 Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CH 1.3%
• CVE-2026-40684 Medium 5.9 In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in 0.4%
• CVE-2026-40685 Medium 6.5 In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation 0.3%
• CVE-2026-40686 Low 3.7 In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged withi 0.2%
• CVE-2026-40687 Medium 4.8 In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processi 0.4%
• CVE-2025-67896 High 7.0 Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation. 0.5%
• CVE-2025-30232 High 8.1 A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. 0.5%
• CVE-2025-26794 High 7.5 Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configu 77.6%
• CVE-2023-42119 Low 3.1 Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability 1.6%
• CVE-2023-42118 High 7.5 Exim libspf2 Integer Underflow Remote Code Execution Vulnerability 8.4%
• CVE-2023-42117 High 8.1 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability 6.8%
• CVE-2023-42116 High 8.1 Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability 3.8%
• CVE-2023-42115 Critical 9.8 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability 12.2%
• CVE-2023-42114 Low 3.7 Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability 27.1%