CVE-2026-94056: Exim Information Disclosure Vulnerability

CVE-2026-94056 Overview

CVE-2026-94056 is an information disclosure vulnerability in the Exim mail transfer agent (MTA) affecting versions before 4.100.1. The flaw exists in Exim's Proxy-Protocol handling code and allows a network-based attacker who controls the upstream proxy to read uninitialized data from Exim's stack memory. The vulnerability is classified under CWE-908: Use of Uninitialized Resource. Exploitation requires no authentication and no user interaction, and Exim must be configured to accept Proxy-Protocol connections from the attacker-controlled proxy.

Critical Impact
An attacker-controlled proxy can leak uninitialized stack memory from Exim over the network, potentially exposing sensitive process data.

Affected Products

Exim MTA versions before 4.100.1
Deployments where Proxy-Protocol is enabled (hosts_proxy configured)
Mail infrastructure fronted by an untrusted or attacker-controlled proxy

Discovery Timeline

2026-09-19 - CVE-2026-94056 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-94056

Vulnerability Analysis

Exim implements the HAProxy PROXY protocol to preserve original client connection metadata when the MTA sits behind a load balancer or reverse proxy. During the parsing of PROXY protocol headers, Exim reads structured data into a stack-allocated buffer and then processes fields based on lengths supplied by the proxy. When those lengths reference regions of the buffer that were never initialized by the connection data, Exim operates on residual stack contents left over from earlier function frames.

The flaw is limited to information disclosure. The attacker cannot directly write to memory or execute code through this path, but leaked stack bytes may include pointers, string fragments, or configuration values useful for defeating address space layout randomization (ASLR) or chaining with other vulnerabilities. The attack is network-reachable and requires no privileges or user interaction.

Root Cause

The root cause is CWE-908: Use of Uninitialized Resource. Exim's Proxy-Protocol parser does not fully zero or bounds-validate the stack buffer used to hold proxy header fields before returning attacker-influenced regions of it to downstream processing. Fields sized by attacker-supplied length values can therefore reference uninitialized bytes adjacent to legitimate parsed data.

Attack Vector

Exploitation requires that the Exim instance is configured with Proxy-Protocol enabled and that the attacker controls, or can impersonate, an authorized proxy listed in hosts_proxy. The attacker crafts a malformed PROXY protocol header with length fields that instruct Exim to read beyond the initialized portion of its parse buffer. Uninitialized stack bytes are then reflected back through log entries, $proxy_* expansion variables used in ACLs, or subsequent SMTP responses, depending on configuration. No authentication to the SMTP service itself is required.

No public exploit or proof-of-concept has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Exim mailing list advisory for the maintainer discussion.

Detection Methods for CVE-2026-94056

Indicators of Compromise

Inbound SMTP connections from Proxy-Protocol sources containing malformed or oversized PROXY v2 TLV (type-length-value) fields.
Exim log entries under paniclog or mainlog referencing PROXY protocol parse anomalies or truncated headers.
Unexpected binary or non-printable data appearing in log fields sourced from $proxy_external_address, $proxy_local_address, or related expansion variables.

Detection Strategies

Inspect SMTP traffic at the network layer for PROXY protocol v2 headers whose declared length exceeds the actual payload size.
Correlate connections from hosts listed in hosts_proxy with unusual outbound response sizes or log verbosity increases.
Audit Exim configuration to identify systems where hosts_proxy includes networks not fully under organizational control.

Monitoring Recommendations

Forward Exim mainlog, rejectlog, and paniclog into a centralized logging platform and alert on PROXY protocol parse errors.
Baseline the set of source IPs performing PROXY protocol handshakes and alert on deviations.
Monitor for outbound connections from mail servers to unexpected destinations, which could indicate follow-on exploitation using leaked pointers.

How to Mitigate CVE-2026-94056

Immediate Actions Required

Upgrade Exim to version 4.100.1 or later on all mail relays and inbound MTAs.
Restrict hosts_proxy to only include IP addresses of trusted, organizationally controlled proxies.
Terminate any Proxy-Protocol trust relationships with third-party or shared-tenant proxies until patching is complete.

Patch Information

The vulnerability is fixed in Exim 4.100.1. Operators should apply the upstream release or the equivalent backported package from their Linux distribution. Refer to the Exim mailing list message for maintainer guidance and confirm the installed version with exim -bV after upgrade.

Workarounds

Disable Proxy-Protocol acceptance by removing or emptying the hosts_proxy directive in exim.conf if the feature is not strictly required.
Enforce network access control lists so that only trusted proxy IP addresses can reach the SMTP listener that accepts PROXY headers.
Front Exim with a proxy or firewall that validates PROXY protocol header structure and rejects malformed headers before they reach Exim.

bash

# Configuration example: disable Proxy-Protocol acceptance in exim.conf
# Comment out or remove the hosts_proxy directive:
# hosts_proxy = 10.0.0.0/24

# Verify the running Exim version after upgrade
exim -bV | head -n 1

# Confirm hosts_proxy is empty or scoped to trusted proxies only
exim -bP hosts_proxy