high CVSS 7.5 EPSS 0.24%

CVE-2026-94056·Exim vulnerability

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

Severity
high
Software
Exim
Fixed in
4.100.1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.24% — higher than 14% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-94056 scores 7.5 on CVSS, so a successful attack would be serious — but at 0.24%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

Until: 4.100.1

Fixed in: 4.100.1

How to fix this CVE

Organizations running Exim mail servers must upgrade to version 4.100.1 or later to eliminate a memory disclosure vulnerability present when Proxy-Protocol is enabled. This flaw allows attackers positioned as a malicious proxy to leak sensitive stack memory contents from the Exim process. Prioritize this update if your infrastructure exposes Exim to untrusted networks or uses reverse proxy configurations.

sudo dnf update exim

Defensia detects this vulnerability

How to check if you are affected

  1. Run 'exim -bV' to display the currently installed Exim version; versions below 4.100.1 are vulnerable
  2. Check if Proxy-Protocol is enabled by examining /etc/exim4/exim4.conf for 'proxy_protocol' or similar configuration directives
  3. Search mail logs at /var/log/exim4/main.log for repeated connection attempts from unexpected proxy sources, particularly with malformed or suspicious PROXY headers
  4. Verify the fix by re-running 'exim -bV' after applying updates and confirming the version is 4.100.1 or higher

FAQ

What is CVE-2026-94056?

This vulnerability allows unauthenticated attackers to read uninitialized stack memory from Exim when the Proxy-Protocol feature is enabled and the connection originates from a compromised or attacker-controlled proxy. The leaked data may contain sensitive information from the mail server process.

Is CVE-2026-94056 being actively exploited?

No, there is currently no evidence of active exploitation in the wild, and no public exploits have been released. However, organizations should still prioritize patching as the vulnerability is relatively straightforward to exploit if Proxy-Protocol is exposed.

What versions of Exim are affected by CVE-2026-94056?

All versions of Exim prior to 4.100.1 are vulnerable to this issue; version 4.100.1 and all subsequent releases contain the remediation.

How do I check if my server is vulnerable to CVE-2026-94056?

Run 'exim -bV | grep version' and verify the version is 4.100.1 or higher. Additionally, confirm whether Proxy-Protocol is active by searching your exim4.conf for 'proxy_protocol' configuration lines.

Does Defensia detect CVE-2026-94056?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Exim is installed on a monitored server, CVE-2026-94056 will appear in your dashboard with remediation steps.

Related Exim CVEs

CVE-2010-4344CVSS 10Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
CVE-2019-16928CVSS 10Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVE-2019-10149CVSS 10A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
CVE-2018-6789CVSS 10An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.
CVE-2026-45185CVSS 9.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-94056. Free for 1 server.

Get started free