Exim vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Exim flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2010-4345 Exim Privilege EscalationExploited since Mar 25, 2022 · CVSS 7.8
• CVE-2010-4344 Exim Heap-Based Buffer OverflowExploited since Mar 25, 2022 · CVSS 9.8
• CVE-2019-16928 Exim Out-of-bounds WriteExploited since Mar 3, 2022 · CVSS 9.8
• CVE-2019-10149 Exim Mail Transfer Agent (MTA) Improper Input ValidationExploited since Jan 10, 2022 · CVSS 9.8
• CVE-2018-6789 Exim Buffer OverflowExploited since Nov 3, 2021 · ransomware · CVSS 9.8

Latest high and critical flaws

• CVE-2026-94056 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.High 7.5 · Sep 19, 2026
• CVE-2026-94054 Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.High 7 · Sep 19, 2026
• CVE-2026-66141 Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.High 7.4 · Jul 24, 2026
• CVE-2026-66140 Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-naHigh 8.4 · Jul 24, 2026
• CVE-2026-45185 Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.Critical 9.8 · May 12, 2026
• CVE-2025-67896 Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly toHigh 7 · Dec 13, 2025
• CVE-2025-30232 A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges.High 8.1 · Mar 27, 2025
• CVE-2025-26794 Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.High 7.5 · Feb 21, 2025
• CVE-2023-42118 Exim libspf2 Integer Underflow Remote Code Execution Vulnerability.High 8.8 · May 2, 2024
• CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability.Critical 9.8 · May 2, 2024
• CVE-2023-42116 Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability.Critical 9.8 · May 2, 2024
• CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability.Critical 9.8 · May 2, 2024
• CVE-2022-37452 Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.Critical 9.8 · Aug 7, 2022
• CVE-2022-37451 Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.High 7.5 · Aug 6, 2022
• CVE-2021-38371 The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending.High 7.5 · Aug 10, 2021
• CVE-2020-28026 Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN).Critical 9.8 · May 6, 2021
• CVE-2020-28025 Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, aHigh 7.5 · May 6, 2021
• CVE-2020-28024 Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intCritical 9.8 · May 6, 2021
• CVE-2020-28023 Exim 4 before 4.94.2 allows Out-of-bounds Read.High 7.5 · May 6, 2021
• CVE-2020-28022 Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer.Critical 9.8 · May 6, 2021
• CVE-2020-28021 Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters.High 8.8 · May 6, 2021
• CVE-2020-28020 Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandlCritical 9.8 · May 6, 2021
• CVE-2020-28019 Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.High 7.5 · May 6, 2021
• CVE-2020-28018 Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.Critical 9.8 · May 6, 2021
• CVE-2020-28017 Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients.Critical 9.8 · May 6, 2021