SB2025121747 - Multiple vulnerabilities in Exim

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025121747

SB2025121747 - Multiple vulnerabilities in Exim

Published: December 17, 2025

Security Bulletin ID SB2025121747
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) SQL injection (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the MAIL FROM field. A remote attacker can send a specially crafted email to the server and execute arbitrary SQL commands within the SQLite database.

Note, the vulnerability exists due to an incomplete fix for #VU104137 (CVE-2025-26794).


2) Heap-based buffer overflow (CVE-ID: CVE-2025-67896)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can send specially crafted data to the server, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References