Exim

Vulnerability activity for Exim: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 4
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 13
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.8CriticalDec 14, 2010Exim Memory corruptionCVE-2010-4344Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.Added to KEV Mar 25, 2022 · 4,118 days after publicationExploited72% likelyExploit codeExploit-DB · Metasploit
7.8HighDec 14, 2010Exim Privilege escalationCVE-2010-4345Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.Added to KEV Mar 25, 2022 · 4,118 days after publicationExploited18% likelyExploit codeExploit-DB · Metasploit
9.8CriticalSep 27, 2019Exim Internet Mailer Memory corruptionCVE-2019-16928Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.Added to KEV Mar 3, 2022 · 887 days after publicationExploited42% likelyDetection
9.0CriticalJun 5, 2019Exim Mail Transfer Agent (MTA) Code / command injectionCVE-2019-10149Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.Added to KEV Jan 10, 2022 · 950 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit
9.8CriticalFeb 8, 2018Exim Memory corruptionCVE-2018-6789Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.Added to KEV Nov 3, 2021 · 1,363 days after publicationExploited82% likelyExploit codeExploit-DBDetection

Recent

4.0MediumSep 19, 2026eximCVE-2026-94057Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
7.5HighSep 19, 2026exim Memory corruptionCVE-2026-94056Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
3.7LowSep 19, 2026exim Memory corruptionCVE-2026-94055Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
7.0HighSep 19, 2026exim Memory corruptionCVE-2026-94054Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
7.4HighJul 24, 2026exim Privilege escalationCVE-2026-66141Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
8.4HighJul 24, 2026exim Path traversal / file handlingCVE-2026-66140Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.
5.3MediumMay 30, 2026eximCVE-2026-48840Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.
9.8CriticalMay 12, 2026exim Memory corruptionCVE-2026-45185Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
4.8MediumApr 30, 2026exim Memory corruptionCVE-2026-40687In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.
3.7LowApr 30, 2026exim Memory corruptionCVE-2026-40686In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.
6.5MediumApr 30, 2026exim Memory corruptionCVE-2026-40685In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an incorrect implementation of \ skipping.
5.9MediumApr 30, 2026eximCVE-2026-40684In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records. This is caused by a dn_expand oddity in octal printing.
7.0HighDec 14, 2025exim Memory corruptionCVE-2025-67896Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
7.8HighDec 14, 2010Exim Privilege escalationCVE-2010-4345Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.Exploited18% likelyExploit codeExploit-DB · Metasploit
9.8CriticalDec 14, 2010Exim Memory corruptionCVE-2010-4344Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.Exploited72% likelyExploit codeExploit-DB · Metasploit
9.8CriticalSep 27, 2019Exim Internet Mailer Memory corruptionCVE-2019-16928Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.Exploited42% likelyDetection
9.0CriticalJun 5, 2019Exim Mail Transfer Agent (MTA) Code / command injectionCVE-2019-10149Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.Exploited100% likelyExploit codeExploit-DB · Metasploit
9.8CriticalFeb 8, 2018Exim Memory corruptionCVE-2018-6789Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.Exploited82% likelyExploit codeExploit-DBDetection

See every Exim entry on the dashboard.