CVE-2026-48840
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.
Risk Assessment
An attacker can read sensitive data from stack memory, potentially leading to information disclosure.
Recommendation
Upgrade Exim to version 4.99.4 or later.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
- CVE-1999-0971High
Buffer overflow in Exim allows local users to gain root privileges via a long :include: option in a .forward file.
Original NVD description (English source)
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.