CVE-2026-94054: Exim Buffer Overflow Vulnerability

CVE-2026-94054 Overview

CVE-2026-94054 is an out-of-bounds write vulnerability [CWE-787] in Exim mail transfer agent versions before 4.100.1. The flaw resides in the Proxy-Protocol handling code and is triggered when Exim is configured to accept connections from an attacker-controlled proxy. An attacker positioned as, or able to control, an upstream proxy can send crafted Proxy-Protocol data that causes Exim to write beyond an allocated buffer. The condition is reachable over the network without authentication or user interaction, but the impact is scoped to confidentiality with no direct integrity or availability effect per the published CVSS vector.

Critical Impact
Attacker-controlled proxies can trigger an out-of-bounds write in Exim, potentially leaking process memory to remote clients over the SMTP listener.

Affected Products

Exim mail transfer agent, all versions prior to 4.100.1
Deployments configured with proxy_protocol_timeout and hosts_proxy enabling Proxy-Protocol
Mail servers fronted by load balancers or reverse proxies forwarding client metadata

Discovery Timeline

2026-09-19 - CVE-2026-94054 published to the National Vulnerability Database
2026-09-24 - Last updated in the NVD database

Technical Details for CVE-2026-94054

Vulnerability Analysis

Exim supports the HAProxy Proxy-Protocol so that a downstream mail server can learn the true client address when connections traverse a load balancer. The parser handling Proxy-Protocol v1 or v2 headers fails to correctly bound the length of attacker-supplied fields before copying them into a fixed-size buffer. When the upstream proxy is under adversary control, malformed length fields or oversized TLV records cause Exim to write past the destination buffer. The result is corruption of adjacent memory in the receiving process. Because Exim runs as the mail delivery user and services inbound SMTP, the writable memory region can influence subsequent processing paths within the same connection.

Root Cause

The root cause is missing or incorrect length validation in the Proxy-Protocol ingestion routine [CWE-787]. Exim trusts the length metadata declared in the Proxy-Protocol header rather than clamping it against the size of the receiving structure. The upstream fix in release 4.100.1 tightens these bounds checks. Consult the Exim mailing list message for the maintainer discussion and patch details.

Attack Vector

Exploitation requires that the target Exim instance is configured to accept Proxy-Protocol from a host the attacker controls, or that the attacker can spoof traffic appearing to originate from an allowed proxy. The attacker opens a TCP session to the SMTP listener and emits a malformed Proxy-Protocol preamble with crafted length fields or TLV data. Exim parses the preamble before any SMTP authentication, so no credentials are required. The out-of-bounds write occurs during preamble processing, and the observable impact per the published metrics is limited to disclosure of adjacent process memory to the connecting client.

No public proof-of-concept exploit is currently available in ExploitDB or referenced by CISA KEV. The vulnerability is not listed as known exploited.

Detection Methods for CVE-2026-94054

Indicators of Compromise

Inbound SMTP connections from hosts listed in hosts_proxy that emit malformed or oversized Proxy-Protocol v1 or v2 preambles.
Exim paniclog or mainlog entries referencing Proxy-Protocol parsing failures, unexpected disconnects, or SIGSEGV on the receiver process.
Unexpected process restarts of the Exim daemon coinciding with connections from proxy-designated source IPs.

Detection Strategies

Inspect Exim mainlog and rejectlog for repeated Proxy-Protocol handshake errors from a single source or subnet.
Deploy network sensors that decode Proxy-Protocol v2 and alert on TLV length fields exceeding the header-declared payload length.
Correlate SMTP connection attempts with load balancer or reverse proxy access logs to identify traffic that bypasses expected proxy chains.

Monitoring Recommendations

Enable core dump collection on Exim hosts and forward crash telemetry to a central log platform for review.
Alert on any host authorized in hosts_proxy originating traffic outside its normal operational baseline.
Track outbound connection metadata from Exim processes for signs of memory content being exfiltrated in SMTP responses.

How to Mitigate CVE-2026-94054

Immediate Actions Required

Upgrade Exim to version 4.100.1 or later on all mail relays that accept Proxy-Protocol.
Audit the hosts_proxy configuration directive and remove any entries that are not strictly required.
Restrict inbound SMTP at the network layer so only trusted load balancer or proxy IPs can reach ports where Proxy-Protocol is enabled.

Patch Information

The fix is included in Exim 4.100.1. Distribution packagers are expected to backport the patch. Refer to the Exim mailing list announcement for the authoritative maintainer notice and to distribution security advisories for backported package versions.

Workarounds

Disable Proxy-Protocol by removing or emptying the hosts_proxy option and restarting Exim if upstream proxies are not required.
Terminate Proxy-Protocol at a hardened load balancer and forward plain SMTP to Exim so the vulnerable parser is not reachable.
Enforce mutual TLS or IP allowlists between the proxy and Exim to prevent spoofed sources from injecting Proxy-Protocol preambles.

bash

# Configuration example: disable Proxy-Protocol acceptance in exim.conf
# Remove or comment out any hosts_proxy definition, then reload Exim
# hosts_proxy = 10.0.0.10 : 10.0.0.11
hosts_proxy =

# Verify no proxy hosts are configured
exim -bP hosts_proxy

# Reload the service
systemctl reload exim