Exim Mail Server Hit by 4 Security Flaws Enabling SMTP Smuggling and Heap Corruption
Exim Mail Server 4.100.1 patches critical out-of-bounds write and SMTP smuggling flaws that could allow remote code execution and message injection.
Exim maintainers released version 4.100.1 to patch four security flaws in the widely used mail transfer agent. The most critical is an out-of-bounds write vulnerability (GCVE-25-2026-09-50-1) in the Proxy Protocol v1 handler, affecting versions 4.83 through 4.100, which could lead to crashes and potential exploitation. The other three flaws enable SMTP smuggling, allowing attackers to inject messages by exploiting parsing inconsistencies between mail infrastructure components.
- Exim 4.100.1 patches four vulnerabilities in the widely used mail server.
- Critical flaw is an out-of-bounds write in Proxy Protocol handling affecting versions 4.83-4.100.
- Other vulnerabilities allow SMTP smuggling, enabling message injection across infrastructure layers.
- Patch requires Proxy Protocol to be enabled, limiting some exposure.
- Administrators must upgrade and review upstream proxy configurations.
Full article527 words · extracted from gbhackers.com · click to collapse
Exim maintainers have released version 4.100.1 to address four security vulnerabilities affecting the widely used mail transfer agent. This update resolves issues that could potentially enable SMTP smuggling and heap-memory corruption under certain configurations.
The release, announced on September 18, fixes the following vulnerabilities: GCVE-25-2026-09-50-1, GCVE-25-2026-09-51-1, GCVE-25-2026-09-55-1, and GCVE-25-2026-09-56-1. Administrators using vulnerable installations of Exim are strongly encouraged to upgrade to version 4.100.1.
Exim Mail Server Hit by 4 Security Flaws
One of thed most critical issues, tracked as EXIM-Security-2026-09-12.1 and GCVE-25-2026-09-50-1, is an out-of-bounds write vulnerability in Exim’s handling of Proxy Protocol version 1 data. This vulnerability affects Exim versions 4.83 through 4.100, which spans over a decade.
According to the advisory, a remote attacker could trigger a read of approximately 230 bytes beyond the end of a heap allocation, followed by a single NUL-byte write immediately after that memory region.
Such memory-safety flaws can lead to crashes, process memory corruption, and, depending on allocator behavior and protections, might create conditions ripe for further exploitation.
However, exploiting this vulnerability requires the deployment to be compiled and configured to use Proxy Protocol. It also depends on the proxy being buggy or compromised, which limits exposure to mail environments where Exim trusts Proxy Protocol metadata from upstream components like load balancers or reverse proxies.
The maintainer’s fix modifies the affected code to ensure the data read is the correct size, preventing out-of-bounds access.
The remaining vulnerabilities affect Exim versions 4.98 through 4.100 and include issues related to SMTP smuggling. SMTP smuggling refers to a parsing problem that can occur when different mail infrastructure components interpret SMTP commands, line endings, or message delimiters inconsistently.
An attacker could exploit these discrepancies, causing one component to treat injected content as part of a legitimate message. At the same time, another processes it as a separate SMTP transaction or command.
In mail environments, these types of flaws can be particularly significant, as SMTP servers typically operate between internet-facing gateways, filtering platforms, relay hosts, and internal delivery systems.
A discrepancy between these layers could undermine security measures, enable message injection, or bypass assumptions made by downstream filtering and routing mechanisms.
The Exim project received the reported issues on August 25 and drafted a fix two days later. Global CVE identifiers were assigned on September 11, and the patched branch along with the 4.100.1 release tag were provided to Exim distribution maintainers before the public release.
Organizations should identify both internet-facing and internal Exim relay servers, check whether Proxy Protocol support is enabled, and prioritize the deployment of Exim 4.100.1.
Administrators should also review the integrity and configuration of upstream proxies supplying Proxy Protocol headers, especially in instances where Exim accepts connections from outside a tightly controlled network boundary.
Security teams are advised to monitor mail server logs for unexpected SMTP session behavior, malformed proxy metadata, unusual delivery patterns, and unexplained Exim process failures while patching is in progress.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.