Description
Stack-based buffer overflow in Exim 4 before 4.33, when the headers_check_syntax option is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code during the header check.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-502 exim-tls - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-501 exim - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-502 vendor-advisory
- DSA-501 vendor-advisory
- 20040506 Buffer overflows in exim, yet still exim much better than windows mailing-list
- http://www.guninski.com/exim1.html
- exim-headerschecksyntax-bo(16077) vdb-entry