[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVk-RG01BdD9qZXY7-hFmoNS5pvsAKoqEEDJIVb47b84":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":76,"topProductsByCves":101,"seoMetadata":103,"meta":112},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},10019,"exim",1,57,5,112,"2025-03-28","e",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},43754,"Exim is a technology vendor with 1 tracked product and 57 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,28,33,41,46,52,57,61,67,71],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":27},"CVE-2019-10149","A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.","2019-06-05",9.8,"v3.1","Critical",0.99961,{"cveId":29,"description":30,"publishedDate":31,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":32},"CVE-2018-6789","An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.","2018-02-08",0.82238,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":25,"severity":38,"isKev":39,"epssScore":40},"CVE-2025-26794","Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.","2025-02-21",7.5,"High",false,0.75782,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":45},"CVE-2010-4344","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.","2010-12-14",0.71794,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":37,"cvssVersion":50,"severity":38,"isKev":39,"epssScore":51},"CVE-2017-16944","The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.","2017-11-25","v3.0",0.6332,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":37,"cvssVersion":25,"severity":38,"isKev":39,"epssScore":56},"CVE-2020-28019","Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.","2021-05-06",0.61061,{"cveId":58,"description":59,"publishedDate":55,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":39,"epssScore":60},"CVE-2020-28018","Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.",0.55834,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":25,"severity":38,"isKev":39,"epssScore":66},"CVE-2023-42118","Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account.\n. Was ZDI-CAN-17578.","2024-05-03",8.8,0.51474,{"cveId":68,"description":69,"publishedDate":49,"cvssScore":24,"cvssVersion":50,"severity":26,"isKev":39,"epssScore":70},"CVE-2017-16943","The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.",0.46705,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":75},"CVE-2019-16928","Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.","2019-09-27",0.41589,[77,82,89,93,97],{"cveId":42,"description":43,"publishedDate":44,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":45,"cisaVulnName":78,"cisaDateAdded":79,"cisaShortDescription":80,"cisaRequiredAction":81},"Exim Heap-Based Buffer Overflow Vulnerability","2022-03-25","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.","Apply updates per vendor instructions.",{"cveId":83,"description":84,"publishedDate":44,"cvssScore":85,"cvssVersion":25,"severity":38,"isKev":4,"epssScore":86,"cisaVulnName":87,"cisaDateAdded":79,"cisaShortDescription":88,"cisaRequiredAction":81},"CVE-2010-4345","Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.",7.8,0.17794,"Exim Privilege Escalation Vulnerability","Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.",{"cveId":72,"description":73,"publishedDate":74,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":75,"cisaVulnName":90,"cisaDateAdded":91,"cisaShortDescription":92,"cisaRequiredAction":81},"Exim Out-of-bounds Write Vulnerability","2022-03-03","Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.",{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":27,"cisaVulnName":94,"cisaDateAdded":95,"cisaShortDescription":96,"cisaRequiredAction":81},"Exim Mail Transfer Agent (MTA) Improper Input Validation","2022-01-10","Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.",{"cveId":29,"description":30,"publishedDate":31,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":32,"cisaVulnName":98,"cisaDateAdded":99,"cisaShortDescription":100,"cisaRequiredAction":81},"Exim Buffer Overflow Vulnerability","2021-11-03","Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.",[102],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":104,"metaDescription":105,"keywords":106,"structuredData":107},"Exim - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Exim covering 1 product with 57 tracked vulnerabilities including 4 critical and 1 high-severity issues and 5 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Exim vulnerabilities, Exim security, Exim CVE, Exim threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Exim KEV, Exim exploited vulnerabilities",{"@context":108,"@type":109,"name":110,"description":105,"url":111},"https:\u002F\u002Fschema.org","Organization","Exim","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fexim",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":113,"apiVersion":114},"2026-10-29T06:10:33.855Z","3.0"]