Advisories · Technology

Exim.

Every CVE that names Exim among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-94057 CVE record

CVSS 4.0 Medium

CRLF injection in Exim
- Exim
- Other injection
Not analysed yet 19 Sept 2026
CVE-2026-94056 CVE record

CVSS 7.5 High

Use of uninitialized resource in Exim
- Exim
- Memory corruption
Not analysed yet 19 Sept 2026
CVE-2026-94055 CVE record

CVSS 3.7 Low

Use after free in Exim
- Exim
- Memory corruption
Not analysed yet 19 Sept 2026
CVE-2026-94054 CVE record

CVSS 7.0 High

Out-of-bounds write in Exim
- Exim
- Memory corruption
Not analysed yet 19 Sept 2026
CVE-2026-66141 CVE record

CVSS 7.4 High

Exim: Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe…
- Exim
- CWE-829
Not analysed yet 24 Jul 2026
CVE-2026-66140 CVE record

CVSS 8.4 High

Path traversal in Exim
- Exim
- Path traversal
Not analysed yet 24 Jul 2026
CVE-2026-48840 CVE record

CVSS 5.3 Medium

Exim: Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads…
- Exim
- CWE-839
Not analysed yet 30 May 2026
CVE-2026-45185 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Exim
- Exim
- Memory corruption
Not analysed yet 12 May 2026
CVE-2026-40687 CVE record

CVSS 4.8 Medium

Exim: In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA…
- Exim
- CWE-909
Not analysed yet 30 Apr 2026
CVE-2026-40686 CVE record

CVSS 3.7 Low

Out-of-bounds read in Exim
- Exim
- Memory corruption
Not analysed yet 30 Apr 2026
CVE-2026-40685 CVE record

CVSS 6.5 Medium

Exim: In Exim before 4.99.2, when JSON lookup is enabled…
- Exim
- CWE-684
Not analysed yet 30 Apr 2026
CVE-2026-40684 CVE record

CVSS 5.9 Medium

Exim: In Exim before 4.99.2, on systems using musl libc (not glibc)…
- Exim
- CWE-684
Not analysed yet 30 Apr 2026
CVE-2025-67896 CVE record

CVSS 7.0 High

Heap-based buffer overflow in Exim
- Exim
- Memory corruption
Not analysed yet 14 Dec 2025
CVE-2025-30232 CVE record

CVSS 8.1 High

Use after free in Exim
- Exim
- Memory corruption
Not analysed yet 27 Mar 2025
CVE-2025-26794 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

SQL injection in Exim
- Exim
- SQL injection
Not analysed yet 21 Feb 2025
CVE-2023-42119 CVE record

CVSS 3.1 Low

Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability
- Exim
- Memory corruption
Not analysed yet 3 May 2024
CVE-2023-42117 CVE record

CVSS 8.1 High

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability
- Exim
- CWE-138
Not analysed yet 3 May 2024
CVE-2023-42116 CVE record

CVSS 8.1 High

Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability
- Exim
- Memory corruption
Not analysed yet 3 May 2024
CVE-2023-42115 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability
- Exim
- Memory corruption
Not analysed yet 3 May 2024
CVE-2023-42114 CVE record

CVSS 3.7 Low

Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability
- Exim
- Memory corruption
Not analysed yet 3 May 2024
CVE-2022-3620 CVE record

CVSS 5.6 Medium

Exim DMARC dmarc.c dmarc_dns_lookup use after free
- Exim
- Memory corruption
Not analysed yet 20 Oct 2022
CVE-2022-3559 CVE record

CVSS 4.6 Medium

Exim Regex use after free
- Exim
- Memory corruption
Not analysed yet 17 Oct 2022
CVE-2019-10149 CVE record

CVSS 9.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

OS command injection in exim
- exim
- Command injection
Not analysed yet 5 Jun 2019