Low

Exim dnsdb Out-of-Bounds Read Information Disclosure

IdentifiersCVE-2023-42119CWE-125· Out-of-bounds Read

CVE-2023-42119 is an out-of-bounds read in Exim's dnsdb DNS lookup subsystem, reachable through the SMTP service. Improper validation of supplied DNS-related data can cause Exim to read beyond an allocated buffer, permitting an unauthenticated network-adjacent attacker to disclose limited sensitive information. The issue is also tracked as ZDI-23-1473.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker can obtain information from memory beyond the intended buffer boundary in the context of the Exim service. The direct impact is limited information disclosure (CVSS v3.1: 3.1); however, disclosed data may assist further exploitation. In combination with a separate vulnerability, the flaw could contribute to arbitrary code execution as the Exim service account.

Mitigation

If you can’t patch tonight, do this now.

Use only a trusted DNS resolver that validates DNS response data according to the expected record types. Restrict network interaction with exposed Exim SMTP services where practical until the fixed version is deployed.

Remediation

Patch, then assume compromise.

Upgrade Exim to a release containing the vendor fix. The vulnerability was reported as fully addressed by Exim version 4.96.2-1; deploy that version or a later supported release after validating the package's security-fix status.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

EximEximapplication

EximMail Transfer Agentapplication

SophosFirewallapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

wiz blogNews

Oct 2, 2023

Exim 0day Vulnerabilities: Everything You Need to Know | Wiz Blog

Low-severity Exim information-disclosure vulnerability associated with use of an untrusted DNS resolver.

cert ssi scadaNews

Dec 11, 2025

Multiples vulnérabilités dans Exim

Vulnérabilité dans le sous-système de recherches DNS d'Exim permettant une lecture hors limites et potentiellement une exécution de code arbitraire en conjonction avec d'autres vulnérabilités.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity