Use of Uninitialized Variable in Exim - CVE-2026-48840
Published: June 1, 2026
Vulnerability identifier: #VU133143
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-48840
CWE-ID: CWE-457
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an uninitialized stack memory use in the PROXY-protocol parser when parsing a crafted PROXY version 2 frame with an insufficient payload length. A remote attacker can send a specially crafted PROXY frame to disclose sensitive information.
Only builds compiled with SUPPORT_PROXY and configured with a non-empty hosts_proxy are vulnerable. To reach the vulnerable code, the source IP must match hosts_proxy or the crafted PROXY header must be forwarded through a host already listed in hosts_proxy.
Affected software
Exim
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim4 (Debian package)
exim
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim4 (Debian package)
exim
How to mitigate CVE-2026-48840
Install security update from vendor's website.
Exim - update to 4.99.4
exim4 (Ubuntu package) - addressed in versions 4.82-3ubuntu2.4+esm9, 4.86.2-2ubuntu2.6+esm9, 4.90.1-1ubuntu1.10+esm6, 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.9, 4.97-4ubuntu4.6, 4.98.2-1ubuntu2.3, 4.99.1-1ubuntu1.3
exim4 (Debian package) - addressed in versions 4.96-15+deb12u10, 4.98.2-1+deb13u3
exim - addressed in versions 4.99.4-1.el8, 4.99.4-1.el9, 4.99.4-1.el10_3, 4.99.4-1.fc43
exim4 (Ubuntu package) - addressed in versions 4.82-3ubuntu2.4+esm9, 4.86.2-2ubuntu2.6+esm9, 4.90.1-1ubuntu1.10+esm6, 4.93-13ubuntu1.12+esm1, 4.95-4ubuntu2.9, 4.97-4ubuntu4.6, 4.98.2-1ubuntu2.3, 4.99.1-1ubuntu1.3
exim4 (Debian package) - addressed in versions 4.96-15+deb12u10, 4.98.2-1+deb13u3
exim - addressed in versions 4.99.4-1.el8, 4.99.4-1.el9, 4.99.4-1.el10_3, 4.99.4-1.fc43