critical CVSS 10 Actively exploited

CVE-2019-16928·Exim vulnerability

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

Severity
critical
Software
Exim
Fixed in
4.92.2-3
Published

Affected versions

Until: 4.92.2-3

Fixed in: 4.92.2-3

How to fix this CVE

Exim versions 4.92 through 4.92.2 contain a critical heap buffer overflow in the EHLO command processing logic that allows unauthenticated remote attackers to execute arbitrary code. Immediately upgrade to Exim 4.92.2-3 or later, or apply patches from your distribution vendor. This vulnerability is actively exploited in the wild and should be treated as a high-priority security incident.

sudo dnf update exim

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

EHLO [domain|hostname]{500,} or regex pattern: ^EHLO\s+[^\s]{500,}$ in SMTP traffic; exploitation attempts typically involve EHLO commands with payloads exceeding 500 characters

How to check if you are affected

  1. Step 1: Check your installed Exim version by running 'exim -bV' or 'dpkg -l | grep exim4' on Debian/Ubuntu systems
  2. Step 2: Verify if Exim is listening on port 25 (SMTP) by running 'sudo netstat -tlnp | grep exim' or 'sudo ss -tlnp | grep exim' to confirm exposure
  3. Step 3: Search your mail logs for suspicious EHLO commands with unusually long payloads using 'grep -i "EHLO.*[A-Za-z0-9]\{500,\}" /var/log/exim4/main.log'
  4. Step 4: Confirm the patch is applied by running 'exim -bV' and verifying the version is 4.92.2-3 or higher

FAQ

What is CVE-2019-16928?

CVE-2019-16928 is a critical remote code execution vulnerability in Exim's EHLO command parser that exploits a heap-based buffer overflow when processing overly long hostname strings. An unauthenticated attacker can send a malicious EHLO command to an exposed Exim server to achieve arbitrary code execution with the privileges of the Exim process.

Is CVE-2019-16928 being actively exploited?

Yes. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited by threat actors in real-world attacks against mail servers.

What versions of Exim are affected by CVE-2019-16928?

Exim versions 4.92 through 4.92.2 (inclusive) are vulnerable. Version 4.92.2-3 and later versions contain the fix.

How do I check if my server is vulnerable to CVE-2019-16928?

Run 'exim -bV | grep -E "Exim version 4\.92\.[0-2]"' to identify vulnerable versions. If this command returns output, your system is vulnerable.

Does Defensia detect CVE-2019-16928?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2019-16928 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.
CVE-2017-16944CVSS 9The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2019-16928. Free for 1 server.

Get started free