Multiple Exim Server Vulnerabilities
Security researchers from the National Institute of Standards and Technology (NIST) have disclosed critical vulnerabilities in Exim 4.99 mail server software that could allow remote attackers to compromise servers.
The flaws affect Exim installations using SQLite hints database implementation and require specific ratelimit configurations to be exploitable.
The vulnerabilities involve two distinct security issues discovered in the SQLite hints database code.
| Attribute | Vulnerability 1 (SQL Injection) | Vulnerability 2 (Heap Buffer Overflow) |
|---|---|---|
| CVE ID | CVE-2025-26794 (Related/Incomplete Fix) | Pending Assignment (New Discovery) |
| Vulnerability Type | SQL Injection | Heap Buffer Overflow |
| CWE ID | CWE-89 | CWE-122, CWE-787, CWE-843 |
The first is an incomplete SQL injection fix related to CVE-2025-26794, where single quotes are not properly escaped by the xtextencode() function.
This allows attackers to inject malicious SQL queries through crafted SMTP addresses, potentially returning attacker-controlled binary data from the database.
The second vulnerability is a heap buffer overflow caused by an unvalidated database field used as an array boundary.
The bloom_size parameter, which controls bloom filter operations, is read directly from the database without validation.
While the bloom array is allocated as 40 bytes, attackers can set bloom_size to values thousands of times larger, causing memory writes far beyond the allocated buffer.
Exploitation requires specific server configurations where ratelimit access control lists use attacker-controlled data in database keys.
Vulnerable configurations include per_addr mode with explicit keys like $sender_address, or explicit unique parameters with sender data.
Default configurations using client IP addresses are not vulnerable since this data cannot be controlled via SMTP protocol.
The vulnerabilities were discovered by Dr. Andrew Fasano, a cyber lead at NIST’s Center for AI Standards and Innovation.
Testing confirmed that attackers could inject SQL code and trigger heap corruption through carefully crafted SMTP transactions.
While full remote code execution was not demonstrated, researchers noted that achieving RCE may be possible with additional exploitation techniques.
The security flaws only affect Exim installations compiled with USE_SQLITE support and configured to use SQLite hints databases.
Organizations running Exim should review their configurations, particularly ratelimit ACL rules that incorporate sender addresses or other attacker-controllable data in database keys.
Exim developers have been notified and are working on patches to address both vulnerabilities.
Recommended fixes include adding proper single quote escaping to the xtextencode() function and implementing validation checks for the bloom_size parameter before using it as an array boundary.
The researcher has requested assignment of two new CVE identifiers for these distinct vulnerabilities.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…