Exim Mail Transfer Agent Releases Critical Security Update to Address Four Vulnerabilities
On September 18, maintainers of the Exim Mail Transfer Agent announced the release of version 4.100.1, a significant update aimed at rectifying four security vulnerabilities that could pose risks to users of the widely utilized email server software. The vulnerabilities, which have been categorized with Global CVE identifiers – GCVE-25-2026-09-50-1, GCVE-25-2026-09-51-1, GCVE-25-2026-09-55-1, and GCVE-25-2026-09-56-1 – have prompted a strong recommendation for all administrators operating vulnerable installations of Exim to upgrade promptly.
Detailed Analysis of the Vulnerabilities
Among the critical issues addressed in this release is a serious out-of-bounds write vulnerability identified as EXIM-Security-2026-09-12.1, which affects Exim versions 4.83 through 4.100. This flaw arises from the software’s handling of Proxy Protocol version 1 data. According to the advisory issued by Exim’s maintainers, an attacker could exploit this vulnerability to read approximately 230 bytes beyond the end of a heap allocation. Following this action, an attacker could execute a single NUL-byte write immediately after the affected memory region.
These memory-safety vulnerabilities are critically dangerous as they can lead to application crashes, process memory corruption, and other scenarios that may be leveraged for further attacks. However, exploiting this particular vulnerability is contingent upon having the deployment compiled and set up to utilize Proxy Protocol, as well as the presence of flaws in the proxy itself. This means that exposure is limited primarily to specific mail environments where Exim relies on untrusted Proxy Protocol metadata from components located upstream, such as load balancers or reverse proxies.
In response, Exim’s maintainers have modified the relevant code to ensure that data reads are conducted at the appropriate size, thereby preventing instances of out-of-bounds access.
SMTP Smuggling Vulnerabilities
The remaining vulnerabilities that prompted the update impact Exim versions 4.98 through 4.100 and pertain to SMTP smuggling issues. SMTP smuggling represents a critical parsing problem, occurring when various components of an email infrastructure misinterpret SMTP commands, line endings, or message delimiters. An attacker could exploit these inconsistencies to have one component incorrectly treat injected content as part of a legitimate message while another component processes it as a separate SMTP transaction or command.
This situation is particularly significant within mail environments, where SMTP servers are typically situated between internet-facing gateways, filtering systems, relay hosts, and internal delivery systems. Any discrepancies or inconsistencies between these layers can significantly undermine security measures, enabling message injection attacks and bypassing filtering and routing mechanisms that safeguard the integrity of email transmissions.
Timeline of Events Leading to the Update
The Exim project was alerted to these reported vulnerabilities on August 25. Quick action was taken, with a fix being drafted within just two days. On September 11, global CVE identifiers were formally assigned, and the patched branch alongside the release tag for version 4.100.1 was distributed to Exim’s maintainers in preparation for the public release.
In light of these developments, organizations utilizing Exim are advised to identify any internet-facing and internal Exim relay servers in operation, assess whether Proxy Protocol support is enabled, and prioritize the deployment of version 4.100.1. Furthermore, administrators are urged to review their upstream proxies’ integrity and configuration, especially in scenarios where Exim is configured to accept connections from outside a tightly controlled network environment.
Ongoing Vigilance Required
In addition to the immediate fix, security teams are encouraged to actively monitor mail server logs for any unexpected behavior during SMTP sessions. This includes watching for malformed proxy metadata, unusual delivery patterns, and any unexplained failures of Exim processes while the patch is being implemented.
The release of Exim version 4.100.1 is a critical step towards fortifying the security framework that underpins email communication for countless organizations globally. As cyber threats continue to evolve, the proactive measures taken by Exim’s maintainers underscore the necessity for heightened vigilance and continuous updates within the cybersecurity landscape.