Actively exploited in the wild
Exim Mail Transfer Agent (MTA) Improper Input Validation
Exim - Mail Transfer Agent (MTA) · Listed in the CISA KEV since 2022-01-10. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-10149
CriticalCVSS 9.8KEVSummary
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Risk Assessment
An attacker could remotely execute arbitrary commands on the mail server, potentially leading to full system compromise. The risk is critical as Exim is a widely used MTA.
Recommendation
Update Exim to version 4.92 or later. If updating is not possible, consider temporarily disabling or restricting access to the service.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2019-16928CriticalActively exploited
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- CVE-2018-6789CriticalActively exploited
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
- CVE-2026-48840Medium
Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.
- CVE-1999-0971High
Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.
Original NVD description (English source)
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.