Full Report
Exim security advisory (AV26-737)
Analysis Summary
# Vulnerability: Critical Buffer Overflow in Exim Mail Server
## CVE Details
- **CVE ID:** GCVE-25-2026-07-45-1 / EXIM-Security-2026-06-22.1 (Official CVE ID pending mapping)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-120 (Buffer Copy without Checking Size of Input)
## Affected Systems
- **Products:** Exim Mail Transfer Agent (MTA)
- **Versions:** 4.88 through 4.99.4
- **Configurations:** Systems utilizing the affected Exim versions for handling incoming SMTP connections are at risk. Specific configurations may depend on the handling of large headers or malformed input.
## Vulnerability Description
The vulnerability is a memory corruption flaw (Heap Buffer Overflow) within Exim's processing of incoming SMTP traffic. Due to improper bounds checking, a remote unauthenticated attacker can craft a specific sequence of commands or malformed data packets that overwrite memory. This can lead to the execution of arbitrary code with the privileges of the Exim process (typically the `exim` user or `root` depending on configuration).
## Exploitation
- **Status:** PoC available (Internal/Researchers); no confirmed reports of exploitation in the wild at the time of advisory release.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to emails and potentially system files)
- **Integrity:** High (Modification of system files or email contents)
- **Availability:** High (Can cause service crashes or total system compromise)
## Remediation
### Patches
- **Update to Exim version 4.99.5 or 5.0** (depending on the release branch).
- Ensure your distribution's package manager is updated to pull the latest security backports if using a Long Term Support (LTS) version.
### Workarounds
- If immediate patching is not possible, limit the `max_header_line_size` in the Exim configuration to a safe value (consult vendor documentation for specific mitigation strings).
- Restrict SMTP access via firewall to trusted IP addresses only, if applicable.
## Detection
- **Indicators of Compromise:** Unusual memory usage spikes in the `exim` process; unexpected child processes spawned by Exim; "Segmentation Fault" or "Signal 11" errors in Exim logs (typically located at `/var/log/exim/mainlog` or `paniclog`).
- **Detection methods and tools:** Use SIEM rules to monitor for unusually large SMTP headers or anomalous binary executions originating from the MTA user.
## References
- Exim Official Advisory: hxxps[://]www[.]exim[.]org/static/doc/security/EXIM-Security-2026-06-22.1/EXIM-Security-2026-06-22.1[.]txt
- Exim Internet Mailer: hxxps[://]www[.]exim[.]org/
- Cyber Centre Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/exim-security-advisory-av26-737