CVE-2026-94054
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Risk Assessment
This may lead to arbitrary code execution or service crash, posing a serious threat to system security.
Recommendation
Update Exim to version 4.100.1 or later. Avoid using Proxy-Protocol with untrusted proxies.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2019-16928CriticalActively exploited
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- CVE-2019-10149CriticalActively exploited
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- CVE-2018-6789CriticalActively exploited
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
- CVE-2026-94057Medium
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
- CVE-2026-94056High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
- CVE-2026-94055Low
Exim before 4.100.1 contains a use-after-free vulnerability that occurs when certain non-default TLS settings are used with GnuTLS.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
Original NVD description (English source)
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS