High severity7.0OSV Advisory· Published Dec 14, 2025· Updated Jun 17, 2026

CVE-2025-67896

Description

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Exim/EximOSV3 versions
DEVEL_PDKIM_START, exim-4.90devstart, exim-4.92, …+ 2 more
- (no CPE)range: DEVEL_PDKIM_START, exim-4.90devstart, exim-4.92, …
- cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*range: <4.99.1
- (no CPE)range: <4.99.1

Patches

Vulnerability mechanics

References

exim.org/static/doc/security/nvdVendor Advisory
exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txtnvdVendor Advisory
www.openwall.com/lists/oss-security/2025/12/14/1nvdMailing List
www.openwall.com/lists/oss-security/2025/12/18/3nvdMailing List
www.openwall.com/lists/oss-security/2025/12/11/2nvdMailing List

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000