Exim Mail Server 4.100.1 Fixes 4 Security Flaws Including SMTP Smuggling and Heap Corruption

Exim 4.100.1 fixes four security vulnerabilities, including high-severity Proxy Protocol and GnuTLS use-after-free flaws and a medium-severity SMTP smuggling issue that could let attackers alter submitted email content.

The security release was announced on September 18, 2026, and affects Exim deployments running versions as old as 4.83 in some configurations. Administrators using impacted versions are strongly advised to upgrade to Exim 4.100.1.

One of the most serious issues, tracked as GCVE-25-2026-09-50-1, affects Exim installations configured to use Proxy Protocol version 1. The flaw is an out-of-bounds write and heap corruption issue.

A remote attacker could trigger a read of roughly 230 bytes beyond the end of a heap allocation and cause a single NUL-byte write at the end of that read.

The issue affects Exim versions 4.83 through 4.100 when Proxy Protocol support is enabled, and the server receives data through a buggy or compromised proxy.

Heap corruption bugs can cause unexpected process behavior, crashes, or potentially more serious security consequences depending on the affected memory layout and system protections. Exim 4.100.1 corrects the data-read sizing logic.

Exim Mail Server 4.100.1 Fixes

A separate high-severity vulnerability, GCVE-25-2026-09-55-1, affects Proxy Protocol version 2 handling. Security researcher McCaulay Hudson of watchTowr reported the issue. The bug stems from uninitialized data and can allow a remote attacker to transmit stack data from the Exim server.

The affected condition exists in Exim versions 4.83 through 4.100 when Proxy Protocol is enabled, and a configured proxy is faulty or compromised.

The updated release changes how Exim receives the Proxy Protocol header, repeating reads until the complete header has been received rather than processing incomplete data.

Exim 4.100.1 also fixes GCVE-25-2026-09-51-1, a low-severity use-after-free issue in GnuTLS TLS-on-connect handling. The flaw affects Exim versions 4.98 through 4.100 when built with GnuTLS 3.6.4 or later. Exploitation additionally requires the non-default tls_early_banner_hosts setting to be enabled.

An attacker could use this condition to trigger a use-after-free and potentially crash a mail reception process. Organizations unable to immediately upgrade can reduce exposure by turning off tls_early_banner_hosts. The new version changes program control flow to prevent use of the freed data.

The fourth issue, GCVE-25-2026-09-56-1, is an SMTP smuggling vulnerability affecting all Exim versions up to and including 4.100. Also reported by Hudson, the bug could allow an attacker to cause an email submission that differs from the message sent and logged by the originating system.

The attack requires Exim to reject a message during the SMTP data phase while the attacker supplies specially crafted content after the rejection point. Exim noted that its usual configured processing still applies to the smuggled message.

However, the behavior may create logging and message-integrity concerns because the mail server can process content not reflected in the sender’s records.

Version 4.100.1 resolves the issue by correctly detecting the end of the SMTP data phase after a rejection. Exim administrators should obtain the signed release from official Exim distribution channels, verify package checksums and signatures, and update exposed mail servers as soon as possible.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC