medium CVSS 5.3 EPSS 0.44%

CVE-2026-48840·Exim vulnerability

Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.

Severity
medium
Software
Exim
Fixed in
4.99.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.44% — higher than 36% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 4.88

Until: 4.99.4

Fixed in: 4.99.4

How to fix this CVE

Update Exim to version 4.99.4 or later to resolve a memory disclosure vulnerability affecting proxy configurations. Organizations running Exim 4.88 through 4.99.3 should prioritize this update as the flaw can expose sensitive stack memory contents to remote clients when processing certain malformed payloads. Apply the patch immediately in production environments to eliminate this information disclosure risk.

sudo dnf update exim

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed Exim version with: exim -bv -d 2>&1 | grep -i version or dpkg -l | grep exim (Debian/Ubuntu) / rpm -qa | grep exim (RHEL/CentOS)
  2. Verify if Exim is configured as a proxy by reviewing /etc/exim4/exim4.conf and searching for 'proxy', 'router', or 'transport' sections that relay traffic
  3. Search mail logs for suspicious short payload patterns: grep -i 'short\|payload\|malform' /var/log/exim4/mainlog or /var/log/exim/main.log
  4. Confirm patch installation by running exim -bv -d 2>&1 | grep -i version and verifying the version is 4.99.4 or higher

FAQ

What is CVE-2026-48840?

This vulnerability allows remote attackers to trigger uninitialized stack memory disclosure in Exim mail servers operating in proxy mode when processing abnormally short SMTP payloads. The flaw affects Exim versions 4.88 through 4.99.3 and has a CVSS score of 5.3 (medium severity).

Is CVE-2026-48840 being actively exploited?

No, this vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available at this time. However, organizations should still apply the patch promptly as a preventive measure.

What versions of Exim are affected by CVE-2026-48840?

Exim versions 4.88 through 4.99.3 are vulnerable. The issue is resolved in Exim 4.99.4 and later releases.

How do I check if my server is vulnerable to CVE-2026-48840?

Run exim -bv -d 2>&1 | head -20 to display the version, or use dpkg -l | grep exim4 (Debian/Ubuntu) / rpm -qa | grep exim (RHEL/CentOS). Compare the version against 4.99.4 — if it is lower and your Exim instance is in proxy mode, your system is vulnerable.

Does Defensia detect CVE-2026-48840?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2026-48840 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-48840. Free for 1 server.

Get started free