Exim Mail Server Hit by 4 Security Flaws Enabling SMTP Smuggling and Heap Corruption
Exim Mail Server 4.100.1 patches critical out-of-bounds write and SMTP smuggling flaws that could allow remote code execution and message injection.
Exim maintainers released version 4.100.1 to patch four security flaws in the widely used mail transfer agent. The most critical is an out-of-bounds write vulnerability (GCVE-25-2026-09-50-1) in the Proxy Protocol v1 handler, affecting versions 4.83 through 4.100, which could lead to crashes and potential exploitation. The other three flaws enable SMTP smuggling, allowing attackers to inject messages by exploiting parsing inconsistencies between mail infrastructure components.
- Exim 4.100.1 patches four vulnerabilities in the widely used mail server.
- Critical flaw is an out-of-bounds write in Proxy Protocol handling affecting versions 4.83-4.100.
- Other vulnerabilities allow SMTP smuggling, enabling message injection across infrastructure layers.
- Patch requires Proxy Protocol to be enabled, limiting some exposure.
- Administrators must upgrade and review upstream proxy configurations.
- Vendors
- Exim
- Products
- Exim Mail Server
From the original article
2 min read at gbhackers.com
Exim maintainers have released version 4. 100. 1 to address four security vulnerabilities affecting the widely used mail transfer agent.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.