Description

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-19T23:17:11.113Z",
  "pubdate": "2026-09-19T23:17:11.113Z",
  "executiveSummary": "This vulnerability concerns an information disclosure flaw in Exim versions prior to 4.100.1 when the Proxy-Protocol is actively utilized.\nThe vulnerability resides in the improper handling of memory initialization during the parsing of Proxy-Protocol headers.\nAn attacker capable of controlling the upstream proxy can trigger the processing of malformed or specific headers, causing the application to read uninitialized data from the stack.\nThe primary impact is the unauthorized disclosure of sensitive information residing in stack memory, which may include pointers, stack canaries, or other internal application state data.\nThis exposure requires the attacker to control the proxy connection, placing the vulnerability within the network-exposed attack surface of the Exim mail transfer agent.\nSuccessful exploitation allows for memory content extraction, potentially facilitating secondary attacks such as bypass of security controls or preparation for code execution exploits by revealing memory layout.",
  "technicalDetails": "The vulnerability in Exim stems from a failure to correctly initialize memory buffers before processing Proxy-Protocol data. When Exim is configured to accept connections via a proxy supporting the Proxy-Protocol, it must parse header information to determine the client's original IP address and connection details.\nRoot Cause: The internal parsing logic fails to ensure that all local stack-allocated variables or buffers intended to store incoming proxy header information are zeroed out or correctly bounded before use. When specific conditions are met during the handshake, the parser may access regions of the stack that contain remnants of previous function calls or persistent process data.\nExploitation Method: An attacker positioned as the upstream proxy sends a specially crafted Proxy-Protocol header. This header is designed to leave certain fields or structure members unpopulated within the expected memory space. Because Exim's internal routines do not initialize these memory segments, the subsequent processing logic inadvertently includes these stale memory contents in its output or log responses.\nAttack Flow: 1. The attacker initiates a connection to the Exim server while masquerading as a trusted proxy. 2. The attacker transmits a malformed or truncated Proxy-Protocol header. 3. The Exim parser encounters the unexpected structure and, failing to initialize the corresponding memory, continues execution using the residual stack data. 4. The application processes the leaked stack data, which may be returned in error responses, connection logs, or stored in transient buffers that the attacker can later retrieve through further interactions or side-channel analysis.\nAffected Versions: All Exim versions prior to 4.100.1 that support Proxy-Protocol are considered vulnerable. The issue is intrinsic to the code paths that handle the header decoding routines.\nAuthentication/Privilege Requirements: No authentication is required, as the vulnerability is triggered during the pre-authentication phase of the SMTP connection or the initial proxy handshake.\nPost-Exploitation Impact: The disclosure of uninitialized stack memory is critical because it may leak pointers that reveal memory addresses, effectively bypassing Address Space Layout Randomization (ASLR). Furthermore, the exposure of stack contents can provide attackers with sensitive artifacts, such as partial session keys or internal configuration values, which are instrumental for escalating privileges or crafting more sophisticated memory corruption exploits."
}