CVE-2026-94054 Exim CVE debrief

Who should care

Defenders responsible for Exim servers, especially those using Proxy-Protocol, should assess exposure and verify configurations to prevent potential exploitation.

Why it matters

A high-severity vulnerability exists in Exim before version 4.100.1 when using Proxy-Protocol with an attacker-controlled proxy, leading to an out-of-bounds write. Defenders should prioritize verifying Exim versions and configurations to prevent potential exploitation.

• Verify Exim versions and configurations to prevent exploitation.
• Update Exim to version 4.100.1 or later if possible.
• Monitor Exim logs for potential exploitation attempts.

Technical summary

Exim before 4.100.1 has an out-of-bounds write vulnerability when using Proxy-Protocol with an attacker-controlled proxy. This vulnerability can lead to potential exploitation attempts, which can be mitigated by verifying Exim versions and configurations, especially those using Proxy-Protocol. Defenders should prioritize verifying Exim versions and configurations to prevent potential exploitation.

Defensive priority

Defenders should prioritize verifying Exim versions and configurations, especially those using Proxy-Protocol, to prevent potential exploitation.

Recommended defensive actions

• Verify Exim versions and configurations to ensure use of Proxy-Protocol with trusted proxies.
• Update Exim to version 4.100.1 or later if possible.
• Monitor Exim logs for potential exploitation attempts.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but additional verification is needed to confirm affected versions and potential exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.