CVE-2026-94055: Exim Use-After-Free Vulnerability

CVE-2026-94055 Overview

CVE-2026-94055 is a use-after-free vulnerability [CWE-416] in the Exim mail transfer agent (MTA) affecting versions prior to 4.100.1. The flaw is triggered when Exim is compiled and configured with GnuTLS support and administrators enable certain non-default TLS settings. A remote attacker can reach the vulnerable code path over the network without authentication or user interaction. Successful exploitation impacts the availability of the Exim service by referencing memory that has already been freed. Exim maintainers published advisory details on the project mailing list (Exim Mailing List Message).

Critical Impact
Unauthenticated remote attackers can trigger a use-after-free condition in Exim's GnuTLS code path, degrading mail service availability on affected hosts.

Affected Products

Exim versions prior to 4.100.1
Exim builds compiled with GnuTLS support
Exim instances configured with non-default TLS settings

Discovery Timeline

2026-09-19 - CVE-2026-94055 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94055

Vulnerability Analysis

The vulnerability resides in Exim's TLS handling when the server is built against GnuTLS. Under specific non-default TLS configurations, Exim references a memory region after it has already been released. Use-after-free defects in network-facing daemons commonly produce crashes, unpredictable behavior, or, depending on allocator state, corruption of subsequent allocations.

Because Exim is an internet-facing SMTP daemon, the vulnerable code path is reachable during normal TLS negotiation with remote peers. The advisory scope indicates availability impact only, consistent with a crash or denial-of-service condition rather than data disclosure or code execution. Administrators running GnuTLS-based deployments with tuned TLS parameters are the primary exposure population.

Root Cause

The root cause is improper lifetime management of a GnuTLS-related object within Exim. When the specific TLS configuration is active, Exim frees the underlying structure but retains and later dereferences a pointer to that region. This is classified under [CWE-416] Use After Free.

Attack Vector

Exploitation occurs over the network by initiating an SMTP session with STARTTLS or a direct TLS connection to a vulnerable Exim server. No credentials or user interaction are required. Refer to the Exim Mailing List Message for protocol-level detail. No public proof-of-concept exploit is available at the time of publication.

Detection Methods for CVE-2026-94055

Indicators of Compromise

Unexpected termination or restart of the exim process on GnuTLS-enabled mail hosts.
Segmentation faults or SIGSEGV events in system logs referencing Exim worker processes.
Repeated abrupt TLS handshake terminations from a common set of remote source addresses.

Detection Strategies

Inventory Exim installations and identify those linked against GnuTLS rather than OpenSSL.
Audit exim.conf for non-default TLS directives such as custom tls_require_ciphers, tls_dhparam, or tls_verify_hosts values.
Correlate SMTP TLS handshake failures with process crash telemetry to surface exploitation attempts.

Monitoring Recommendations

Forward Exim logs and OS-level crash events to a centralized data lake for query and alerting.
Alert on process restart loops for exim binaries and on core dumps produced by mail daemons.
Track inbound SMTP connections from unusual geographies or high-volume single-source bursts.

How to Mitigate CVE-2026-94055

Immediate Actions Required

Upgrade all Exim instances to version 4.100.1 or later.
Identify servers running Exim with GnuTLS and prioritize those with modified TLS configuration for patching.
Restrict inbound SMTP exposure to required networks while patches are staged.

Patch Information

Exim 4.100.1 addresses the use-after-free defect. Distribution maintainers typically backport the fix; verify the installed package version against your Linux vendor's security advisories. Consult the upstream Exim Mailing List Message for authoritative release information.

Workarounds

Revert to default TLS settings in exim.conf until the patched version is deployed.
Rebuild Exim against OpenSSL instead of GnuTLS where operationally acceptable.
Rate-limit inbound SMTP connections and enforce connection quotas per source to reduce crash-loop impact.

bash

# Configuration example: verify installed Exim version and TLS library
exim -bV | grep -E "Exim version|GnuTLS|OpenSSL"

# Debian/Ubuntu: apply vendor updates
sudo apt update && sudo apt install --only-upgrade exim4 exim4-daemon-heavy

# RHEL/Rocky/Alma: apply vendor updates
sudo dnf update exim

# Confirm the running process picks up the patched binary
sudo systemctl restart exim4 || sudo systemctl restart exim