CVE-2026-94057
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Risk Assessment
An attacker can inject spoofed emails, potentially leading to phishing or malware distribution.
Recommendation
Update Exim to version 4.100.1 or later. Configure SMTP server to reject malformed sequences.
Other vulnerabilities in Exim
See all- CVE-2016-1531High
Exim versions before 4.86.2, when installed setuid root, allow local users to gain privileges via the perl_startup argument.
- CVE-2026-45185Critical
Exim versions before 4.99.3, in certain GnuTLS configurations, has a use-after-free vulnerability in the BDAT body parsing path. This can lead to heap corruption when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection.
- CVE-2019-16928CriticalActively exploited
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
- CVE-2019-10149CriticalActively exploited
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
- CVE-2018-6789CriticalActively exploited
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.
- CVE-2026-94056High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
- CVE-2026-94055Low
Exim before 4.100.1 contains a use-after-free vulnerability that occurs when certain non-default TLS settings are used with GnuTLS.
- CVE-2026-94054High
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.
- CVE-2026-66141High
In Exim before 4.99.5, a privilege escalation vulnerability exists via .forward files. The force_command for pipe transport is mishandled, allowing arbitrary command execution with elevated privileges.
- CVE-2026-66140High
In Exim before version 4.99.5, mishandling of arguments related to queue-name allows directory traversal outside the spool area, potentially leading to privilege escalation.
Original NVD description (English source)
Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA processing.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS