critical CVSS 10 Actively exploited EPSS 82% Public exploit available

CVE-2018-6789·Exim vulnerability

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.

Severity
critical
Software
Exim
Fixed in
4.90.1-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 82% — in the top 0.3% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 4.90.1-1

Fixed in: 4.90.1-1

How to fix this CVE

Upgrade Exim to version 4.90.1-1 or later immediately, as this critical vulnerability allows remote code execution through a buffer overflow in the SMTP base64 decoder without authentication. The flaw can be triggered by a specially crafted email message, making any exposed Exim server at severe risk. Verify the patch is applied and restart the Exim service after updating.

sudo dnf update exim

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

SMTP traffic containing base64-encoded payloads in AUTH or MAIL FROM commands followed by buffer overflow patterns (repeated sequences of \x41-\x5a or NOP sleds \x90), particularly if followed by x86 shellcode opcodes (\x55\x89\xe5 or similar prologue patterns)

How to check if you are affected

  1. Check installed Exim version: exim -v | grep 'Exim version'
  2. Verify SMTP service is listening: netstat -tlnp | grep -i exim or ss -tlnp | grep exim
  3. Search mail logs for suspicious base64-encoded SMTP commands: grep -i 'base64\|AUTH' /var/log/exim4/mainlog | grep -E '(\x00|\xff|overflow)'
  4. Confirm patch applied: dpkg -l | grep exim4 (Debian/Ubuntu) or rpm -qa | grep exim (RHEL/CentOS), verify version is 4.90.1-1 or higher

FAQ

What is CVE-2018-6789?

CVE-2018-6789 is a critical buffer overflow vulnerability in Exim's SMTP base64 decoder that permits remote code execution without authentication. An attacker can craft a malicious email message to overflow the decoder buffer and execute arbitrary commands on the mail server.

Is CVE-2018-6789 being actively exploited?

Yes, CVE-2018-6789 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and public exploits are available on ExploitDB (exploits #45671 and #44571), indicating widespread active exploitation in the wild.

What versions of Exim are affected by CVE-2018-6789?

All versions of Exim prior to and including 4.90.1 are vulnerable. The vulnerability was patched in version 4.90.1-1 and later.

How do I check if my server is vulnerable to CVE-2018-6789?

Run 'exim -v' and check if the version is below 4.90.1-1. If SMTP is exposed on port 25 and the version is vulnerable, your server is at immediate risk.

Does Defensia detect CVE-2018-6789?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2018-6789 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
CVE-2017-16944CVSS 9The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2018-6789. Free for 1 server.

Get started free