Loading story…
Exim maintainers and downstream vendors disclosed and patched multiple vulnerabilities affecting the mail transfer agent, including a blind SQL injection issue tied to SQLite-backed hints databases, a related incomplete fix that left the injection path reachable in later code, and a heap buffer overflow in ratelimit handling. The SQL injection stemmed from attacker-controlled keys being interpolated into SQLite queries without escaping single quotes, while the heap overflow was caused by using an unvalidated bloom_size value from database records as the bound for a fixed 40-byte bloom buffer. The issues affected deployments using specific Exim configurations such as SQLite hints databases and ratelimit ACLs with attacker-influenced sender data.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
A SUSE Bugzilla entry identified CVE-2026-45185 as a remotely reachable use-after-free vulnerability in Exim's BDAT body parsing path. The reference establishes the flaw's existence and affected component, though it does not provide exploitation or patch details.
An oss-security post announced Exim security release 4.99.3. While the provided reference does not include the full advisory text, it indicates a coordinated upstream release to address Exim security flaws.
An Exim security report stated that Andrew Fasano of NIST had privately disclosed two vulnerabilities in Exim 4.99's SQLite-based hints database implementation: an incomplete fix for CVE-2025-26794 and a separate heap buffer overflow in ratelimit handling. The report included technical root-cause details, proof-of-concept exploitation notes, and recommendations for parameterized queries and bounds validation.
cPanel issued a product advisory warning that multiple vulnerabilities had been reported for Exim. The provided reference does not include technical details, but it marks a vendor response acknowledging the security issues.
A public GitHub write-up described CVE-2025-26794 as a blind SQL injection vulnerability in Exim 4.98 affecting the SQLite DBM-related functionality. This appears to be the first public reference in the provided sources to the issue and its exploit details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
bugzilla.suse.com
Open sourceopenwall.com
Open sourcecode.exim.org
Open sourcesupport.cpanel.net
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Exim maintainers released **Exim 4.99.3** to fix a critical remotely reachable use-after-free flaw in the SMTP server’s **BDAT** body parsing path, tracked as **`CVE-2026-45185`** and referred to as **Dead.Letter**. The vulnerability affects **Exim 4.97 through 4.99.2/4.99.x** when built with **GnuTLS** support and configured to advertise both **`STARTTLS`** and **`CHUNKING`**, and successful exploitation can cause heap corruption with potential remote code execution. Maintainers said Linux distributions received coordinated access to patches ahead of disclosure and urged users to upgrade immediately. According to the advisory and follow-on reporting, the bug is triggered when a client sends a TLS **`close_notify`** before a BDAT transfer finishes and then sends a final cleartext byte over the same TCP connection, leaving Exim in an unsafe state. Exim said there are no effective mitigations short of upgrading, and fixed the issue in **4.99.3** by resetting the input-processing stack when TLS shutdown occurs during an active BDAT transfer. The flaw was reported by **Federico Kirschbaum of XBOW security**, with fuller technical details to be published under **`EXIM-Security-2026-05-01.1`**.
Jun 29, 2026
Exim has released **version 4.99.2** as a security update to fix four vulnerabilities in the mail transfer agent, tracked as `CVE-2026-40684`, `CVE-2026-40685`, `CVE-2026-40686`, and `CVE-2026-40687`. The flaws affect specific configurations and stem from unsafe handling of DNS PTR data, corrupt JSON in headers, malformed UTF-8 in headers, and the SPA authenticator when interacting with a hostile or compromised external SPA/NTLM service. Reported impacts include crashes, heap corruption, out-of-bounds reads and writes, and possible heap data leakage, with older Exim branches potentially affected but no longer actively maintained. One of the disclosed issues, `CVE-2026-40684`, can crash an Exim connection on systems using **musl libc** when malformed DNS PTR record data is processed; the same behavior was not reported on glibc systems. Exim said the bug is linked to an octal-printing oddity in musl libc and noted that the issue was raised with the musl maintainer. The fixes were published through Exim's security advisory process and made available in source tarballs and the project's Git repository under the `exim-4.99.2` tag.
Jun 29, 2026
Exim released **version 4.100.1** to remediate four security vulnerabilities in its mail transfer agent, including an SMTP smuggling flaw that can cause submitted email content to differ from the message delivered and logged by the originating system. The update also addresses a conditional GnuTLS TLS-on-connect use-after-free issue that could crash a mail reception process. Two high-severity flaws in Exim's Proxy Protocol handling can cause heap corruption or expose server-stack data when Proxy Protocol is enabled and a configured proxy is faulty, buggy, or compromised. Some affected code dates to Exim 4.83; administrators should upgrade internet-facing servers to 4.100.1, validate signed release packages, and disable `tls_early_banner_hosts` as a temporary mitigation where immediate patching is not possible.
Sep 21, 2026