CVE-2025-67896
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In Exim before 4.99.1, with certain non-default rate-limit configurations, a remote heap-based buffer overflow exists because database records are cast directly to internal structures without validation.
Risk Assessment
A remote attacker can exploit the buffer overflow to execute arbitrary code or cause a crash of the mail server, potentially leading to system compromise.
Recommendation
Update Exim to version 4.99.1 or later, which contains the fix. Review rate-limit configurations for compliance with recommendations.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2019-16928CriticalActively exploited
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- CVE-2019-10149CriticalActively exploited
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- CVE-2018-6789CriticalActively exploited
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
- CVE-2026-94057Medium
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
- CVE-2026-94056High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
- CVE-2026-94055Low
Exim before 4.100.1 contains a use-after-free vulnerability that occurs when certain non-default TLS settings are used with GnuTLS.
- CVE-2026-94054High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
Original NVD description (English source)
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS