Use of Uninitialized Variable in Exim - CVE-2026-94056
Published: September 29, 2026 / Updated: October 7, 2026
Vulnerability identifier: #VU152757
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-94056
CWE-ID: CWE-457
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose stack data.
The vulnerability exists due to the use of uninitialized data in Proxy Protocol v2 handling when processing Proxy Protocol v2 data from a configured proxy. A remote attacker can supply Proxy Protocol v2 data through the configured proxy to disclose stack data.
The installation must be built and configured for Proxy-Protocol use, and the configured proxy must be buggy or compromised.
Affected software
Exim
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim
exim4 (Debian package)
Debian Linux
Fedora
Ubuntu
exim4 (Ubuntu package)
exim
exim4 (Debian package)
How to mitigate CVE-2026-94056
Install security update from vendor's website.
Exim - update to 4.100.1
exim4 (Ubuntu package) - addressed in versions 4.95-4ubuntu2.12, 4.97-4ubuntu4.8, 4.99.1-1ubuntu1.5
exim - addressed in versions 4.100.1-1.el8, 4.100.1-1.el9, 4.100.1-1.el10_4, 4.100.1-1.fc43
exim4 (Debian package) - update to 4.98.2-1+deb13u5
exim4 (Ubuntu package) - addressed in versions 4.95-4ubuntu2.12, 4.97-4ubuntu4.8, 4.99.1-1ubuntu1.5
exim - addressed in versions 4.100.1-1.el8, 4.100.1-1.el9, 4.100.1-1.el10_4, 4.100.1-1.fc43
exim4 (Debian package) - update to 4.98.2-1+deb13u5