Exim (Vendor): news timeline & CVEs

Exim security advisory (AV26-944)

Canada's Cyber Centre warns Exim versions before 4.100.1 are vulnerable and urges administrators to update.

The Canadian Centre for Cyber Security issued advisory AV26-944 on 21 September 2026, stating that as of 18 September 2026 Exim versions before 4.100.1 are affected by vulnerabilities. The notice points administrators to Exim's 4.100.1 security release and urges them to apply available updates. It does not name CVE identifiers, describe the flaws, or say whether exploitation has been observed.

Canadian Centre for Cyber SecuritySep 21, 14:51 UTC · 5d agoAdvisory

Exim Mail Server 4.100.1 Fixes 4 Security Flaws Including SMTP Smuggling and Heap Corruption

Exim 4.100.1 patches four flaws, including high-severity Proxy Protocol heap corruption, uninitialized data leak, GnuTLS use-after-free, and SMTP smuggling.

Exim released version 4.100.1 on September 18, 2026, fixing four vulnerabilities affecting versions from 4.83 to 4.100 depending on configuration. GCVE-25-2026-09-50-1 is an out-of-bounds write in Proxy Protocol v1 handling allowing a ~230-byte over-read and NUL-byte write; GCVE-25-2026-09-55-1 leaks stack data via uninitialized memory in Proxy Protocol v2 handling. A low-severity GnuTLS use-after-free (GCVE-25-2026-09-51-1) requires the non-default tls_early_banner_hosts setting, and GCVE-25-2026-09-56-1 permits SMTP smuggling that can alter submitted email content. Administrator upgrades to 4.100.1 are strongly advised; issues were reported by McCaulay Hudson of watchTowr.

Cyber Security NewsSep 21, 07:51 UTC · 6d agoVulnerability 2 sources

Exim Mail Server Hit by 4 Security Flaws Enabling SMTP Smuggling and Heap Corruption

Exim Mail Server 4.100.1 patches critical out-of-bounds write and SMTP smuggling flaws that could allow remote code execution and message injection.

Exim maintainers released version 4.100.1 to patch four security flaws in the widely used mail transfer agent. The most critical is an out-of-bounds write vulnerability (GCVE-25-2026-09-50-1) in the Proxy Protocol v1 handler, affecting versions 4.83 through 4.100, which could lead to crashes and potential exploitation. The other three flaws enable SMTP smuggling, allowing attackers to inject messages by exploiting parsing inconsistencies between mail infrastructure components.

GBHackersupdated Sep 21, 07:51 UTC · 6d agofirst Sep 21, 06:48 UTC · 6d agoVulnerability 2 sources

Exim Security Release 4.100.1

Exim released security update 4.100.1 addressing vulnerabilities in the widely used open-source mail transfer agent; details remain sparse.

Solar Designer posted an oss-security notice pointing to an Exim-announce message from Bernard Quatermass dated September 18, 2026, announcing Exim Security Release 4.100.1. The public post contains no CVE identifiers, description of the fixed flaws, or exploitation details, linking instead to the official Exim mailing list announcement. Exim is a widely deployed mail transfer agent with a history of critical vulnerabilities, so administrators should apply the update promptly.

oss-securitySep 19, 03:53 UTC · 8d agoAdvisory

Exim

Timeline4 articles

Appears with

Exim security advisory (AV26-944)

Exim Mail Server 4.100.1 Fixes 4 Security Flaws Including SMTP Smuggling and Heap Corruption

Exim Mail Server Hit by 4 Security Flaws Enabling SMTP Smuggling and Heap Corruption

Exim Security Release 4.100.1