EX
Vendor
exim
72
CVEs
7
On KEV
0
New 30D
Products
EX9.8
exim
exim
70 CVEs5 on KEV0 new
EI9.8
Exim Internet Mailer
Exim
1 CVEs1 on KEV0 new
MT9.8
Mail Transfer Agent (MTA)
Exim
1 CVEs1 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-94057 | EX Exim Exim | 5.3 | Sep 19 | Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a rejection during DATA… |
| CVE-2026-94056 | EX Exim Exim | 7.5 | Sep 19 | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory |
| CVE-2026-94055 | EX Exim Exim | 5.3 | Sep 19 | Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free |
| CVE-2026-94054 | EX Exim Exim | 5.3 | Sep 19 | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write |
| CVE-2026-66141 | EX Exim Exim | 7.8 | Jul 24 | Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled |
| CVE-2026-66140 | EX Exim Exim | 7.8 | Jul 24 | Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled |
| CVE-2026-48840 | EX Exim Exim | 5.3 | May 30 | Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client |
| CVE-2026-45185 | EX Exim Exim | 9.8 | May 12 | Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path |
| CVE-2026-40685 | EX Exim Exim | 9.8 | Apr 30 | In Exim before 4.99.2, when JSON lookup is enabled, an out-of-bounds heap write can occur when a JSON operator encounters malformed JSON in an untrusted header, because of an… |
| CVE-2026-40687 | EX Exim Exim | 9.1 | Apr 30 | In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or… |
| CVE-2026-40686 | EX Exim Exim | 5.3 | Apr 30 | In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data) |
| CVE-2026-40684 | EX Exim Exim | 7.5 | Apr 30 | In Exim before 4.99.2, on systems using musl libc (not glibc), an attacker can crash the connection instance when malformed DNS data is present in PTR records |
| CVE-2025-67896 | EX Exim Exim | 9.8 | Dec 14 | Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal… |
| CVE-2025-30232 | EX Exim Exim | 7.8 | Mar 28 | A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges |
| CVE-2025-26794 | EX Exim Exim | 9.8 | Feb 21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection |
| CVE-2024-39929 | EX Exim Exim | 5.4 | Jul 4 | Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially… |
| CVE-2023-42119 | EX Exim Exim | 3.1 | May 3 | Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2023-42117 | EX Exim Exim | 9.8 | May 3 | Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability |
| CVE-2023-42116 | EX Exim Exim | 9.8 | May 3 | Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability |
| CVE-2023-42115 | EX Exim Exim | 9.8 | May 3 | Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability |
| CVE-2023-42114 | EX Exim Exim | 5.3 | May 3 | Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability |
| CVE-2023-51766 | EX Exim Exim | 5.3 | Dec 24 | Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations |
| CVE-2022-3620 | EX Exim Exim | 9.8 | Oct 20 | Exim DMARC dmarc.c dmarc_dns_lookup use after free |
| CVE-2022-3559 | EX Exim Exim | 7.5 | Oct 17 | Exim Regex use after free |
| CVE-2022-37452 | EX Exim Exim | 9.8 | Aug 7 | Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set |
| CVE-2022-37451 | EX Exim Exim | 7.5 | Aug 6 | Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc |
| CVE-2021-38371 | EX Exim Exim | 7.5 | Aug 10 | The STARTTLS feature in Exim through 4.94.2 allows response injection (buffering) during MTA SMTP sending |
| CVE-2021-27216 | EX Exim Exim | 6.3 | May 6 | Exim 4 before 4.94.2 has Execution with Unnecessary Privileges |
| CVE-2020-28026 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters, relevant in non-default configurations that enable Delivery Status Notification (DSN) |
| CVE-2020-28025 | EX Exim Exim | 7.5 | May 6 | Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkim_finish_bodyhash does not validate the relationship between sig->bodyhash.len and b->bh.len; thus, a crafted… |
| CVE-2020-28024 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.94.2 allows Buffer Underwrite that may result in unauthenticated remote attackers executing arbitrary commands, because smtp_ungetc was only intended to push back… |
| CVE-2020-28023 | EX Exim Exim | 7.5 | May 6 | Exim 4 before 4.94.2 allows Out-of-bounds Read |
| CVE-2020-28022 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.94.2 has Improper Restriction of Write Operations within the Bounds of a Memory Buffer |
| CVE-2020-28021 | EX Exim Exim | 8.8 | May 6 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters |
| CVE-2020-28020 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.92 allows Integer Overflow to Buffer Overflow, in which an unauthenticated remote attacker can execute arbitrary code by leveraging the mishandling of continuation… |
| CVE-2020-28019 | EX Exim Exim | 7.5 | May 6 | Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences |
| CVE-2020-28018 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL |
| CVE-2020-28017 | EX Exim Exim | 9.8 | May 6 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients |
| CVE-2020-28016 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase |
| CVE-2020-28015 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters |
| CVE-2020-28014 | EX Exim Exim | 6.1 | May 6 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges |
| CVE-2020-28013 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.('" on the command line, and thus may allow privilege escalation from any user to root |
| CVE-2020-28012 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Exposure of File Descriptor to Unintended Control Sphere because rda_interpret uses a privileged pipe that lacks a close-on-exec flag |
| CVE-2020-28011 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Heap-based Buffer Overflow in queue_run via two sender options: -R and -S |
| CVE-2020-28010 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the current working directory pathname into a buffer that is too small (on… |
| CVE-2020-28009 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow because get_stdinput allows unbounded reads that are accompanied by unbounded increases in a certain size variable |
| CVE-2020-28008 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges |
| CVE-2020-28007 | EX Exim Exim | 7.8 | May 6 | Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges |
| CVE-2020-12783 | EX Exim Exim | 7.5 | May 11 | Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c |
| CVE-2020-8015 | EX Exim Exim | 7.8 | Apr 2 | A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of exim in openSUSE Factory allows local attackers to escalate from user mail to root |
| CVE-2019-16928 In wildKEV | EX Exim Exim | 9.8 | Sep 27 | Exim Out-of-bounds Write Vulnerability |
| CVE-2019-15846 | EX Exim Exim | 9.8 | Sep 6 | Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash |
| CVE-2019-13917 | EX Exim Exim | 9.8 | Jul 25 | Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an… |
| CVE-2019-10149 In wildKEV | EX exim exim | 9.8 | Jun 5 | Exim Mail Transfer Agent (MTA) Improper Input Validation |
| CVE-2018-6789 RansomwareIn wildKEV | EX Exim Exim | 9.8 | Feb 8 | Exim Buffer Overflow Vulnerability |
| CVE-2017-16944 | EX Exim Exim | 7.5 | Nov 25 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via… |
| CVE-2017-16943 | EX Exim Exim | 9.8 | Nov 25 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via… |
| CVE-2017-1000369 | EX Exim Exim | 4.0 | Jun 19 | Exim supports the use of multiple "-p" command line arguments which are malloc()'ed and never free()'ed, used in conjunction with other issues allows attackers to cause arbitrary… |
| CVE-2016-9963 | EX Exim Exim | 5.9 | Feb 1 | Exim before 4.87.1 might allow remote attackers to obtain the private DKIM signing key via vectors related to log files and bounce messages |
| CVE-2016-1531 | EX Exim Exim | 7.0 | Apr 7 | Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument |