high CVSS 7 EPSS 6.3% Public exploit available

CVE-2016-1531·Exim vulnerability

Exim before 4.86.2, when installed setuid root, allows local users to gain privileges via the perl_startup argument.

Severity
high
Software
Exim
Fixed in
4.86.2-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 6.3% — in the top 7% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 4.86.2-1

Fixed in: 4.86.2-1

How to fix this CVE

Upgrade Exim to version 4.86.2 or later to eliminate a local privilege escalation vulnerability that affects setuid-root installations. Installations running older versions with Perl support enabled should prioritize this update, as the vulnerability allows authenticated local users to execute arbitrary code with root privileges through improper handling of Perl startup parameters.

sudo dnf update exim -y

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'exim -bV' and confirm the installed version is below 4.86.2; affected versions display version numbers prior to 4.86.2-1
  2. Check if Exim is installed with setuid-root permissions by running 'ls -la $(which exim)' and verifying if the setuid bit is set (output should show 's' in permission bits)
  3. Search Exim logs (typically in /var/log/exim4/) for unusual perl_startup directive usage or references with patterns like 'perl_startup.*exec' or 'perl_startup.*system'
  4. Verify the patch was applied by running 'exim -bV' again and confirming the version is 4.86.2 or higher, and review /var/log/apt/history.log for successful package upgrade entries

FAQ

What is CVE-2016-1531?

CVE-2016-1531 is a local privilege escalation flaw in Exim mail servers that allows authenticated local users to escalate privileges to root when Exim is configured with setuid-root permissions and Perl support is enabled. The vulnerability stems from unsafe handling of the perl_startup configuration parameter.

Is CVE-2016-1531 being actively exploited?

CVE-2016-1531 is not listed in CISA's Known Exploited Vulnerabilities catalog, but public proof-of-concept exploits are available on Exploit-DB, making practical exploitation feasible for local attackers.

What versions of Exim are affected by CVE-2016-1531?

All Exim versions before and including 4.86.1 are vulnerable; Exim 4.86.2 and later versions contain the fix.

How do I check if my server is vulnerable to CVE-2016-1531?

Run 'exim -bV | grep version' to check your current version; if it returns a version lower than 4.86.2, your system is vulnerable. Additionally, confirm setuid is enabled with 'stat $(which exim) | grep Access' to verify the vulnerability is exploitable.

Does Defensia detect CVE-2016-1531?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2016-1531 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2016-1531. Free for 1 server.

Get started free