CVE-2016-1531
HighSummary
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
Risk Assessment
This vulnerability may lead to unauthorized access to the system by local users, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade Exim to version 4.86.2 or later and consider changing setuid settings to minimize risk.
Other vulnerabilities in Exim
See all- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2019-16928CriticalActively exploited
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- CVE-2019-10149CriticalActively exploited
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- CVE-2018-6789CriticalActively exploited
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
- CVE-2026-94057Medium
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
- CVE-2026-94056High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
- CVE-2026-94055Low
Exim before 4.100.1 contains a use-after-free vulnerability that occurs when certain non-default TLS settings are used with GnuTLS.
- CVE-2026-94054High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
Original NVD description (English source)
Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS