PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-16928 Exim CVE debrief

CVE-2019-16928 is an out-of-bounds write vulnerability in Exim Internet Mailer. CISA included it in the Known Exploited Vulnerabilities catalog on 2022-03-03 and set a remediation due date of 2022-03-17, which makes this a high-priority patching item for any environment running Exim.

Vendor
Exim
Product
Exim Internet Mailer
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-03-03
Original CVE updated
2022-03-03
Advisory published
2022-03-03
Advisory updated
2022-03-03

Who should care

Administrators, mail-system owners, and security teams responsible for Exim Internet Mailer deployments, especially internet-facing mail servers.

Technical summary

The available corpus identifies the issue as an out-of-bounds write in Exim Internet Mailer. CISA’s KEV entry marks the vulnerability as known exploited and directs affected users to apply updates per vendor instructions. The supplied sources do not provide a version range, attack vector, or deeper exploitation details.

Defensive priority

Urgent. CISA added this CVE to KEV and assigned a short remediation window, so exposed Exim deployments should be prioritized for immediate update and validation.

Recommended defensive actions

  • Identify all systems running Exim Internet Mailer, including externally exposed mail relays and internal mail infrastructure.
  • Apply vendor-recommended updates or mitigations as soon as possible, following Exim’s official guidance.
  • Verify remediation across the fleet and confirm the affected service is no longer running vulnerable builds.
  • Review adjacent mail-server monitoring and incident logs for signs of abnormal behavior around the remediation window.

Evidence notes

This debrief is based on the supplied CISA KEV record and official CVE/NVD references. The source corpus confirms the vulnerability name, product, KEV inclusion, date added, and remediation due date, but does not include affected versions, CVSS metrics, or exploit mechanics beyond the out-of-bounds write classification.

Official resources

Public advisory material is available through the official CVE and NVD records, and CISA lists this CVE in the Known Exploited Vulnerabilities catalog.