CVE-2026-66141 | High | 7.4 | 2026-07-24 | Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled. |
CVE-2026-66140 | High | 8.4 | 2026-07-24 | Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-n… |
CVE-2026-48840 | Medium | 5.3 | 2026-05-30 | Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a clien… |
CVE-2026-45185 | Critical | 9.8 | 2026-05-12 | Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client send… |
CVE-2026-40687 | Medium | 4.8 | 2026-04-30 | In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connec… |
CVE-2026-40686 | Low | 3.7 | 2026-04-30 | In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header d… |
CVE-2026-40685 | Medium | 6.5 | 2026-04-30 | In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header… |
CVE-2026-40684 | Medium | 5.9 | 2026-04-30 | In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records… |
CVE-2025-67896 | High | 7.0 | 2025-12-14 | Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly t… |
CVE-2025-30232 | High | 8.1 | 2025-03-28 | A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. |
CVE-2025-26794 | High | 7.5 | 2025-02-21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1… |
CVE-2024-39929 | Medium | 5.4 | 2024-07-04 | Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechani… |
CVE-2023-42119 | Low | 3.1 | 2024-05-03 | Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on a… |
CVE-2023-42118 | High | 8.8 | 2024-05-03 | Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected… |
CVE-2023-42117 | Critical | 9.8 | 2024-05-03 | Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a… |
CVE-2023-42116 | Critical | 9.8 | 2024-05-03 | Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af… |
CVE-2023-42115 | Critical | 9.8 | 2024-05-03 | Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installatio… |
CVE-2023-42114 | Medium | 5.3 | 2024-05-03 | Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on af… |
CVE-2023-51766 | Medium | 5.3 | 2023-12-24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e… |
CVE-2022-3620 | Medium | 5.6 | 2022-10-20 | A vulnerability was found in Exim and classified as problematic. This issue affects the function dmarc_dns_lookup of the file dmarc.c of the component DMARC Ha… |
CVE-2022-3559 | Medium | 4.6 | 2022-10-17 | A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation le… |
CVE-2022-37452 | Critical | 9.8 | 2022-08-07 | Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set. |
CVE-2022-37451 | High | 7.5 | 2022-08-06 | Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc. |
CVE-2021-38371 | High | 7.5 | 2021-08-10 | The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending. |
CVE-2021-27216 | Medium | 6.3 | 2021-05-06 | Exim 4 before 4.94.2 has Execution with Unnecessary Privileges. By leveraging a delete_pid_file race condition, a local user can delete arbitrary files as root… |
CVE-2020-28026 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN). Cer… |
CVE-2020-28025 | High | 7.5 | 2021-05-06 | Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus… |
CVE-2020-28024 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only in… |
CVE-2020-28023 | High | 7.5 | 2021-05-06 | Exim 4 before 4.94.2 allows Out-of-bounds Read. smtp_setup_msg may disclose sensitive information from process memory to an unauthenticated SMTP client. |
CVE-2020-28022 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer. This occurs when processing name=value pairs within MAI… |
CVE-2020-28021 | High | 8.8 | 2021-05-06 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which… |
CVE-2020-28020 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishand… |
CVE-2020-28019 | High | 7.5 | 2021-05-06 | Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain g… |
CVE-2020-28018 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. |
CVE-2020-28017 | Critical | 9.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote expl… |
CVE-2020-28016 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase. |
CVE-2020-28015 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. Local users can alter the behavior of root processes because a recipient address can have… |
CVE-2020-28014 | Medium | 6.1 | 2021-05-06 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. The -oP option is available to the exim user, and allows a denial of service because root-ow… |
CVE-2020-28013 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any us… |
CVE-2020-28012 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec fl… |
CVE-2020-28011 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S. This may cause privilege escalation from exim to root. |
CVE-2020-28010 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that… |
CVE-2020-28009 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a ce… |
CVE-2020-28008 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory (owned by a non-root user), an attacker… |
CVE-2020-28007 | High | 7.8 | 2021-05-06 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the log directory (owned by a non-root user), a symlink or… |
CVE-2020-12783 | High | 7.5 | 2020-05-11 | Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c. |
CVE-2020-8015 | High | 8.4 | 2020-04-02 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root… |
CVE-2019-16928 | Critical | 9.8 | 2019-09-27 | Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat i… |
CVE-2019-15846 | Critical | 9.8 | 2019-09-06 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash. |
CVE-2019-13917 | Critical | 9.8 | 2019-07-25 | Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can… |
CVE-2019-10149 | Critical | 9.8 | 2019-06-05 | A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead t… |
CVE-2018-6789 | Critical | 9.8 | 2018-02-08 | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. Thi… |
CVE-2017-16944 | High | 7.5 | 2017-11-25 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack ex… |
CVE-2017-16943 | Critical | 9.8 | 2017-11-25 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (… |
CVE-2017-1000369 | Medium | 4.0 | 2017-06-19 | Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers… |
CVE-2016-9963 | Medium | 5.9 | 2017-02-01 | Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages. |
CVE-2016-1531 | High | 7.0 | 2016-04-07 | Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument. |
CVE-2014-2972 | | | 2014-09-04 | expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted l… |
CVE-2014-2957 | | | 2014-09-04 | The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From… |
CVE-2012-5671 | | | 2012-10-31 | Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and a… |
CVE-2011-1764 | | | 2011-10-05 | Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or… |
CVE-2011-1407 | | | 2011-05-16 | The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote at… |
CVE-2011-0017 | | | 2011-02-02 | The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to… |
CVE-2010-4345 | High | 7.8 | 2010-12-14 | Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with… |
CVE-2010-4344 | Critical | 9.8 | 2010-12-14 | Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session… |
CVE-2010-2024 | | | 2010-06-07 | transports/appendfile.c in Exim before 4.72, when MBX locking is enabled, allows local users to change permissions of arbitrary files or create arbitrary files… |
CVE-2010-2023 | | | 2010-06-07 | transports/appendfile.c in Exim before 4.72, when a world-writable sticky-bit mail directory is used, does not verify the st_nlink field of mailbox files, whic… |