Description

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-19T23:17:10.827Z",
  "pubdate": "2026-09-19T23:17:10.827Z",
  "executiveSummary": "Exim versions prior to 4.100.1 are susceptible to an out-of-bounds write vulnerability triggered during the processing of Proxy-Protocol headers.\nThis vulnerability is categorized as an improper bounds check, which can lead to memory corruption when the application handles specially crafted data from an attacker-controlled proxy.\nThe flaw affects systems configured to use the Proxy-Protocol, typically deployed in environments where traffic is routed through load balancers or proxy servers.\nSuccessful exploitation allows an unauthorized remote attacker to overwrite memory, which may lead to arbitrary code execution or a denial-of-service condition depending on the application's memory layout and runtime state.\nThe risk is considered critical due to the potential for remote code execution in the context of the Exim mail transfer agent (MTA).\nExploitation does not require authentication, as the vulnerability is triggered during the initial handshake process between the proxy and the Exim service.\nDefensive measures require upgrading to the patched version of Exim or restricting access to the proxy listener to trusted sources only.",
  "technicalDetails": "The vulnerability resides within the Proxy-Protocol parsing logic of the Exim mail transfer agent. When Exim is configured to accept connections using the Proxy-Protocol, it expects a specifically formatted header containing metadata about the original client connection.\nThe root cause is an insufficient validation of input lengths provided within the Proxy-Protocol header. When an attacker-controlled proxy supplies a malicious header, the internal parser fails to properly account for the boundaries of the assigned buffer when copying data.\nDuring the parsing process, if the supplied length or metadata fields are crafted to exceed the allocated stack or heap buffer, the application performs an out-of-bounds write operation. This memory corruption overwrites adjacent memory addresses.\nThe attack flow initiates when the Exim MTA accepts a connection from a source acting as a proxy. The attacker transmits a malformed Proxy-Protocol header. As the parser processes the header fields, the memory safety violation occurs, allowing the attacker to inject arbitrary data into memory locations that were not intended to be modified.\nBecause the vulnerability occurs at the entry point of the connection handling process, it is exposed over the network to any entity capable of establishing a connection to the proxy-enabled Exim listener.\nThe exploitation process typically involves providing a payload designed to overwrite control structures or function pointers. By carefully aligning the out-of-bounds write, an attacker may redirect the execution flow of the Exim process to execute arbitrary shellcode or malicious instructions injected into the memory space.\nThe impact of this exploit is severe, as Exim often runs with high privileges on a mail server. Compromise of the MTA allows for full control over mail transit, sensitive data exfiltration, or lateral movement within the network.\nAffected versions include all Exim installations prior to 4.100.1 that have the Proxy-Protocol configuration enabled. Systems that do not use Proxy-Protocol or are running version 4.100.1 or later are not susceptible to this specific memory corruption flaw."
}