CVE-2010-4344

CVE-2010-4344 is a heap-based buffer overflow in the string_vformat function in string.c in the Exim mail transfer agent, affecting all Exim versions before 4.70. A remote attacker can trigger the overflow by sending crafted data during an SMTP session, corrupting heap memory and executing arbitrary code on the mail server; the flaw is widely known as the Exim remote root because successful exploitation yields full control of the host. Any organization running an Exim version prior to 4.70 is affected, and because Exim processes unauthenticated SMTP traffic from the internet, exposed mail servers are directly reachable by attackers. The vulnerability is confirmed exploited in the wild, having been added to the CISA Known Exploited Vulnerabilities catalog on 2022-03-25, with a high EPSS score of 71.9% (99th percentile) indicating strong exploitation likelihood; ransomware use is unknown and no public proof-of-concept is cataloged.

What to do: Upgrade Exim to version 4.70 or later per vendor instructions, which is CISA's required action for this KEV entry. Inventory all mail servers and check the Exim version in SMTP banners (e.g., on ports 25/587) for builds below 4.70, prioritizing internet-facing hosts. If patching must be delayed, restrict SMTP access to trusted sources and monitor for anomalous SMTP traffic on those systems.