Critical severity · published Feb 21, 2025
CVE-2025-26794
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection
9.8
CVSS
77.5%
EPSS
No
On KEV
Description
Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1 in certain non-default rate-limit configurations.)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)77.5% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Exim · Exim
4.98 before 4.98.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-26794
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-26794
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1237424
Patch
https://code.exim.org/exim/exim/commit/bfe32b5c6ea033736a26da8421513206db9fe305
Product
https://exim.org
exim.org
https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
Vendor Advisory
https://github.com/Exim/exim/wiki/EximSecurity
Release Notes
https://github.com/NixOS/nixpkgs/pull/383926
More from Exim
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
9.8
CVE-2018-6789
Exim Buffer Overflow Vulnerability
9.8
CVE-2010-4344
Exim Heap-Based Buffer Overflow Vulnerability
7.8
CVE-2010-4345
Exim Privilege Escalation Vulnerability