Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Exim Remote Buffer Overflow in Certain Configurations

CVE-2025-67896 · published 10 months ago
Summary

Non-standard Exim configurations can be exploited by attackers to cause a potentially severe security breach. This affects older versions of Exim, and organizations using these configurations should update to the latest version to prevent potential security risks. Applying the recommended configuration settings is also essential to mitigate this issue.

What to do
  • Update debian exim4 to version 4.99-7.
  • Update exim exim to version 4.99.1 or later.
Affected software
Ecosystem VendorProductAffected versions
– exim exim < 4.99.1
cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*
Debian:14 debian exim4 < 4.99-7
Fix: upgrade to 4.99-7
Original advisory text
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-122Heap-based Buffer Overflow
Timeline
Published14 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-67896 · NVD
CVE-2025-67896 · OSV
DEBIAN-CVE-2025-67896 · OSV
Track software like this
Free during beta