CVE-2020-28016

—

CVSS 3.1

7.8 high

EPSS

<1%p33

Published

May 6, 2021 (May 6, 2021)

Modified

Jun 17, 2026

Description

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parse_fix_phrase.

Vendors: exim
Products: exim
Weakness: CWE-787
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news4 stories

21 vulnerabilities found in Exim, update your instances ASAP!

Help Net SecurityJan 19, 11:45 UTC · Jan 19, 2023Vulnerability CVE-2020-28017 CVE-2020-28020 CVE-2020-28023+15 CVEs

60

ALERT — New 21Nails Exim Bugs Expose Millions of Email Servers to Hacking

The Hacker NewsMay 8, 11:47 UTC · May 8, 2021Vulnerability in the wildCVE-2020-28017 CVE-2020-28007 CVE-2020-28008+19 CVEs

60

Most of Exim email servers could be hacked by exploiting 21Nails flaws

Security AffairsMay 4, 17:10 UTC · May 4, 2021Vulnerability CVE-2020-28007 CVE-2020-28008 CVE-2020-28014+21 CVEs

60

21Nails vulnerabilities impact 60% of the internet's email servers

The RecordDec 7, 00:00 UTC · Dec 7, 2022Vulnerability CVE-2020-28007 CVE-2020-28008 CVE-2020-28014+21 CVEs

47