Loading story…
Exim maintainers disclosed and fixed CVE-2026-48840, a pre-authentication information disclosure flaw in Exim’s PROXY protocol handling that affects versions 4.88 through 4.99.3 and is fixed in 4.99.4. The bug is triggered during SMTP HELO/greeting processing when Exim parses a specially crafted PROXYv2 header with insufficient length, causing uninitialized stack data to be copied into an IP address string and exposed in the SMTP banner. Advisories say the leak can disclose 16 bytes on TCPv6 or 4 bytes on TCPv4, including userspace pointers that could help attackers bypass ASLR and support further exploitation.
The issue affects deployments built with SUPPORT_PROXY and configured with a non-empty hosts_proxy value, a combination reported as enabled by default in some downstream builds including Debian, Ubuntu, RHEL EPEL, and Fedora. Exim said exposure is highest where attackers can reach the service from trusted proxy IPs or through a trusted proxy path, and recommended upgrading to 4.99.4, restricting hosts_proxy to exact load balancer addresses, or disabling PROXY protocol parsing entirely by unsetting that option. Related downstream advisories were also issued by cPanel and Debian for packaged Exim deployments.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Debian published security advisory DSA 6309-1 for exim4 in response to the Exim vulnerability. This indicates downstream distribution action to address the issue in Debian packages.
The Exim maintainers' advisory for CVE-2026-48840 was publicly released, describing an uninitialized-stack information disclosure in PROXY protocol handling. The disclosure explained that malformed PROXYv2 frames can leak memory in SMTP greetings, including pointers useful for ASLR bypass.
MITRE assigned CVE-2026-48840 to the Exim PROXY-protocol information disclosure issue. The advisory identifies it as a pre-authentication flaw that can leak stack memory and aid ASLR bypass.
cPanel published a security advisory for CVE-2026-48840 under identifier EXIM-Security-2026-05-19.1. The advisory concerns the Exim vulnerability addressed in the May 2026 security release.
Exim maintainers disclosed that CVE-2026-48840 affects versions 4.88 through 4.99.3 and is fixed in Exim 4.99.4. They recommended upgrading, restricting hosts_proxy to exact trusted proxy IPs, or disabling PROXY protocol parsing.
The vulnerable PROXY protocol handling code associated with CVE-2026-48840 dates back to Exim 4.88. The flaw affects builds using SUPPORT_PROXY together with a non-empty hosts_proxy configuration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
lists.debian.org
Open sourceopennet.ru
Open sourceopennet.me
Open sourcesupport.cpanel.net
Open sourceseclists.org
Open sourcelists.exim.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Exim has released **version 4.99.2** as a security update to fix four vulnerabilities in the mail transfer agent, tracked as `CVE-2026-40684`, `CVE-2026-40685`, `CVE-2026-40686`, and `CVE-2026-40687`. The flaws affect specific configurations and stem from unsafe handling of DNS PTR data, corrupt JSON in headers, malformed UTF-8 in headers, and the SPA authenticator when interacting with a hostile or compromised external SPA/NTLM service. Reported impacts include crashes, heap corruption, out-of-bounds reads and writes, and possible heap data leakage, with older Exim branches potentially affected but no longer actively maintained. One of the disclosed issues, `CVE-2026-40684`, can crash an Exim connection on systems using **musl libc** when malformed DNS PTR record data is processed; the same behavior was not reported on glibc systems. Exim said the bug is linked to an octal-printing oddity in musl libc and noted that the issue was raised with the musl maintainer. The fixes were published through Exim's security advisory process and made available in source tarballs and the project's Git repository under the `exim-4.99.2` tag.
Jun 29, 2026
Exim maintainers released **Exim 4.99.3** to fix a critical remotely reachable use-after-free flaw in the SMTP server’s **BDAT** body parsing path, tracked as **`CVE-2026-45185`** and referred to as **Dead.Letter**. The vulnerability affects **Exim 4.97 through 4.99.2/4.99.x** when built with **GnuTLS** support and configured to advertise both **`STARTTLS`** and **`CHUNKING`**, and successful exploitation can cause heap corruption with potential remote code execution. Maintainers said Linux distributions received coordinated access to patches ahead of disclosure and urged users to upgrade immediately. According to the advisory and follow-on reporting, the bug is triggered when a client sends a TLS **`close_notify`** before a BDAT transfer finishes and then sends a final cleartext byte over the same TCP connection, leaving Exim in an unsafe state. Exim said there are no effective mitigations short of upgrading, and fixed the issue in **4.99.3** by resetting the input-processing stack when TLS shutdown occurs during an active BDAT transfer. The flaw was reported by **Federico Kirschbaum of XBOW security**, with fuller technical details to be published under **`EXIM-Security-2026-05-01.1`**.
Jun 29, 2026
Exim maintainers released **Exim 4.99.5** to fix two local privilege-escalation vulnerabilities affecting multiple prior versions of the mail transfer agent. According to the security advisory, `EXIM-Security-2026-06-22.1` is a local directory traversal issue affecting Exim **4.88 through 4.99.4** that can let a local user access files outside the spool directory through queue-name transfer command-line arguments, while `EXIM-Security-2026-06-22.3` is a command-execution flaw affecting **4.82 through 4.99.4** in certain `.forward` and pipe transport configurations. The project said there is **no mitigation** for the directory traversal bug short of upgrading, and that the command-execution issue can be reduced by avoiding `force_command` on pipe transports. Release listings and distribution archives show the patched version has been published through Exim's official release channels, and administrators are being urged to update to **4.99.5** to prevent local file access and privilege-escalation risks on affected systems.
Jul 25, 2026