[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVk-RG01BdD9qZXY7-hFmoNS5pvsAKoqEEDJIVb47b84":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":19,"kevVulnerabilities":74,"topProductsByCves":99,"seoMetadata":101,"meta":110},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":18},10019,"exim",1,57,5,112,"2025-03-28","e",[16],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},43754,"Exim is a technology vendor with 1 tracked product and 57 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[20,28,33,41,46,52,57,61,65,70],{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":27},"CVE-2019-10149","A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.","2019-06-05",9.8,"v3.1","Critical",0.99961,{"cveId":29,"description":30,"publishedDate":31,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":32},"CVE-2018-6789","An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may happen. This can be used to execute code remotely.","2018-02-08",0.82137,{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":25,"severity":38,"isKev":39,"epssScore":40},"CVE-2025-26794","Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.","2025-02-21",7.5,"High",false,0.77486,{"cveId":42,"description":43,"publishedDate":44,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":45},"CVE-2010-4344","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.","2010-12-14",0.71706,{"cveId":47,"description":48,"publishedDate":49,"cvssScore":37,"cvssVersion":50,"severity":38,"isKev":39,"epssScore":51},"CVE-2017-16944","The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.","2017-11-25","v3.0",0.63358,{"cveId":53,"description":54,"publishedDate":55,"cvssScore":37,"cvssVersion":25,"severity":38,"isKev":39,"epssScore":56},"CVE-2020-28019","Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. This occurs because use of certain getc functions is mishandled when a client uses BDAT instead of DATA.","2021-05-06",0.61664,{"cveId":58,"description":59,"publishedDate":55,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":39,"epssScore":60},"CVE-2020-28018","Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.",0.56475,{"cveId":62,"description":63,"publishedDate":49,"cvssScore":24,"cvssVersion":50,"severity":26,"isKev":39,"epssScore":64},"CVE-2017-16943","The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.",0.47149,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":69},"CVE-2019-16928","Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.","2019-09-27",0.41638,{"cveId":71,"description":72,"publishedDate":55,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":39,"epssScore":73},"CVE-2020-28017","Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.",0.36899,[75,80,87,91,95],{"cveId":42,"description":43,"publishedDate":44,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":45,"cisaVulnName":76,"cisaDateAdded":77,"cisaShortDescription":78,"cisaRequiredAction":79},"Exim Heap-Based Buffer Overflow Vulnerability","2022-03-25","Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session.","Apply updates per vendor instructions.",{"cveId":81,"description":82,"publishedDate":44,"cvssScore":83,"cvssVersion":25,"severity":38,"isKev":4,"epssScore":84,"cisaVulnName":85,"cisaDateAdded":77,"cisaShortDescription":86,"cisaRequiredAction":79},"CVE-2010-4345","Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands, as demonstrated by the spool_directory directive.",7.8,0.17965,"Exim Privilege Escalation Vulnerability","Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.",{"cveId":66,"description":67,"publishedDate":68,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":69,"cisaVulnName":88,"cisaDateAdded":89,"cisaShortDescription":90,"cisaRequiredAction":79},"Exim Out-of-bounds Write Vulnerability","2022-03-03","Exim contains an out-of-bounds write vulnerability which can allow for remote code execution.",{"cveId":21,"description":22,"publishedDate":23,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":27,"cisaVulnName":92,"cisaDateAdded":93,"cisaShortDescription":94,"cisaRequiredAction":79},"Exim Mail Transfer Agent (MTA) Improper Input Validation","2022-01-10","Improper validation of recipient address in deliver_message() function in \u002Fsrc\u002Fdeliver.c may lead to remote command execution.",{"cveId":29,"description":30,"publishedDate":31,"cvssScore":24,"cvssVersion":25,"severity":26,"isKev":4,"epssScore":32,"cisaVulnName":96,"cisaDateAdded":97,"cisaShortDescription":98,"cisaRequiredAction":79},"Exim Buffer Overflow Vulnerability","2021-11-03","Exim contains a buffer overflow vulnerability in the base64d function part of the SMTP listener that may allow for remote code execution.",[100],{"id":17,"product_name":8,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":102,"metaDescription":103,"keywords":104,"structuredData":105},"Exim - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Exim covering 1 product with 57 tracked vulnerabilities including 4 critical and 1 high-severity issues and 5 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Exim vulnerabilities, Exim security, Exim CVE, Exim threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Exim KEV, Exim exploited vulnerabilities",{"@context":106,"@type":107,"name":108,"description":103,"url":109},"https:\u002F\u002Fschema.org","Organization","Exim","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fexim",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":111,"apiVersion":112},"2026-10-28T17:00:00.483Z","3.0"]