exim vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20246
3. 20253
4. 202612

Known exploitedNewest addition to KEV first

• CVE-2019-10149

  A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead…

  exim · exim

  ExploitedCritical9.0

Newest CVEs

• CVE-2026-94057

  Exim before 4.100.1 allows SMTP smuggling in which the received message does not match any sent message, and instead depends on crafted data sent after a…

  Exim · Exim

  Medium4.0
• CVE-2026-94056

  Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

  Exim · Exim

  High7.5
• CVE-2026-94055

  Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.

  Exim · Exim

  Low3.7
• CVE-2026-94054

  Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

  Exim · Exim

  High7.0
• CVE-2026-66141

  Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.

  Exim · Exim

  High7.4
• CVE-2026-66140

  Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to…

  Exim · Exim

  High8.4
• CVE-2026-48840

  Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a…

  Exim · Exim

  Medium5.3
• CVE-2026-45185

  Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client…

  Exim · Exim

  Critical9.8
• CVE-2026-40687

  In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the…

  Exim · Exim

  Medium4.8
• CVE-2026-40686

  In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header…

  Exim · Exim

  Low3.7