Out-of-bounds write in Exim - CVE-2026-94054
Published: September 29, 2026 / Updated: October 7, 2026
Vulnerability identifier: #VU152755
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-94054
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause an out-of-bounds heap read and write.
The vulnerability exists due to an out-of-bounds write in Proxy Protocol v1 handling when processing Proxy Protocol v1 data from a configured proxy. A remote attacker can supply Proxy Protocol v1 data through the configured proxy to cause an out-of-bounds heap read and write.
The installation must be built and configured for Proxy-Protocol use, and the configured proxy must be buggy or compromised.
Affected software
Exim
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim
exim4 (Debian package)
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim
exim4 (Debian package)
How to mitigate CVE-2026-94054
Install security update from vendor's website.
Exim - update to 4.100.1
exim4 (Ubuntu package) - addressed in versions 4.95-4ubuntu2.12, 4.97-4ubuntu4.8, 4.99.1-1ubuntu1.5
exim - addressed in versions 4.100.1-1.el8, 4.100.1-1.el9, 4.100.1-1.el10_4, 4.100.1-1.fc43
exim4 (Debian package) - update to 4.98.2-1+deb13u5
exim4 (Ubuntu package) - addressed in versions 4.95-4ubuntu2.12, 4.97-4ubuntu4.8, 4.99.1-1ubuntu1.5
exim - addressed in versions 4.100.1-1.el8, 4.100.1-1.el9, 4.100.1-1.el10_4, 4.100.1-1.fc43
exim4 (Debian package) - update to 4.98.2-1+deb13u5