critical CVSS 9 EPSS 63% Public exploit available

CVE-2017-16944·Exim vulnerability

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

Severity
critical
Software
Exim
Fixed in
4.89-13
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 63% — in the top 0.8% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 4.89-13

Fixed in: 4.89-13

How to fix this CVE

Upgrade Exim to version 4.89-13 or later to fix a critical denial-of-service flaw in the SMTP BDAT command handler. Organizations running Exim versions 4.88 or 4.89 before the patch should prioritize this update to prevent remote attackers from triggering infinite loops and stack exhaustion on mail servers. Apply the patch immediately and monitor mail service logs for signs of exploitation during and after the update.

sudo dnf update exim

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

BDAT [0-9]+ (CR)?LF(?!\.).*BDAT [0-9]+|Exim process memory fault|stack exhaustion error|Segmentation fault in receive_msg

How to check if you are affected

  1. Run 'exim -v' or 'exim --version' to determine the currently installed Exim version and confirm it is 4.88.x or 4.89-12 or earlier
  2. Check if Exim SMTP daemon is running by executing 'systemctl status exim4' (Debian/Ubuntu) or 'systemctl status exim' (RHEL/CentOS) to verify the service is active
  3. Search Exim logs for BDAT command errors with 'grep -i "bdat" /var/log/exim4/mainlog' or equivalent log path to identify any malformed BDAT requests
  4. After patching, re-run 'exim -v' to confirm the version is 4.89-13 or higher and restart Exim with 'sudo systemctl restart exim4' or 'sudo systemctl restart exim'

FAQ

What is CVE-2017-16944?

CVE-2017-16944 is a critical denial-of-service vulnerability in Exim's SMTP daemon that exploits improper validation of BDAT command termination, allowing remote attackers to cause stack exhaustion and infinite loops without authentication.

Is CVE-2017-16944 being actively exploited?

According to CISA KEV data, CVE-2017-16944 is not currently listed as actively exploited; however, public exploits are available, so the threat remains high for unpatched systems.

What versions of Exim are affected by CVE-2017-16944?

Exim versions 4.88 and 4.89 up to and including 4.89-12 are affected. The vulnerability was fixed in Exim 4.89-13 and later releases.

How do I check if my server is vulnerable to CVE-2017-16944?

Run 'exim -v' to display the installed version; if it shows 4.88.x or 4.89-12 or earlier, your system is vulnerable and requires immediate patching.

Does Defensia detect CVE-2017-16944?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2017-16944 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2017-16944. Free for 1 server.

Get started free