Exim Mail Server 4.100.1 Patches Critical SMTP Smuggling and Heap Corruption Flaws
Exim 4.100.1 addresses four vulnerabilities, including high-severity heap corruption via Proxy Protocol handling and a medium-severity SMTP smuggling flaw.
Exim, a widely used Mail Transfer Agent (MTA), has released version 4.100.1 to patch four security vulnerabilities, two of which are rated as high severity. The update addresses critical issues related to Proxy Protocol handling that can lead to heap corruption and stack data leakage, as well as a medium-severity SMTP smuggling flaw that could allow attackers to alter email content.
Two high-severity vulnerabilities affect Exim installations configured to use Proxy Protocol versions 1 and 2. The first, GCVE-25-2026-09-50-1, is an out-of-bounds write and heap corruption issue that can occur when Exim receives data through a compromised or faulty proxy. This flaw allows a remote attacker to read approximately 230 bytes beyond the allocated heap memory and write a NUL byte, potentially leading to unexpected process behavior or crashes. This vulnerability impacts Exim versions 4.83 through 4.100 when Proxy Protocol is enabled.
The second high-severity Proxy Protocol vulnerability, GCVE-25-2026-09-55-1, stems from uninitialized data handling in version 2 of the protocol. Reported by security researcher McCaulay Hudson, this bug can enable a remote attacker to exfiltrate stack data from the Exim server. Similar to the first issue, it affects Exim versions 4.83 through 4.100 when Proxy Protocol is enabled and a proxy is misconfigured or compromised. The fix in 4.100.1 involves adjusting how Exim receives and processes the Proxy Protocol header to ensure complete data reception.
A medium-severity SMTP smuggling vulnerability, GCVE-25-2026-09-56-1, also reported by Hudson, affects all Exim versions up to and including 4.100. This flaw allows an attacker to craft an email submission that differs from the message originally sent and logged by the originating system. The attack exploits a scenario where Exim rejects a message during the SMTP data phase, but the attacker manages to inject specially crafted content afterward. While Exim's standard processing applies to the smuggled message, this can lead to discrepancies in logging and message integrity, as the mail server might process content not reflected in the sender's records. Version 4.100.1 resolves this by accurately detecting the end of the SMTP data phase following a rejection.
Additionally, Exim 4.100.1 addresses GCVE-25-2026-09-51-1, a low-severity use-after-free vulnerability in its GnuTLS handling. This issue affects Exim versions 4.98 through 4.100 when built with GnuTLS 3.6.4 or later, and requires the non-default tls_early_banner_hosts setting to be enabled. An attacker could exploit this to cause a mail reception process to crash. Organizations unable to upgrade immediately can mitigate this specific risk by disabling the tls_early_banner_hosts option.
Administrators are strongly advised to upgrade to Exim 4.100.1 as soon as possible. The release is available through official Exim distribution channels, and users should verify package checksums and signatures to ensure integrity. Prompt patching is crucial to protect against potential exploitation of these vulnerabilities, which could impact mail server integrity, confidentiality, and availability.
These vulnerabilities highlight the ongoing need for diligent security practices in maintaining mail server infrastructure. Exim, being a critical component in email delivery for many organizations, requires regular updates to safeguard against evolving threats. The combination of Proxy Protocol flaws, SMTP smuggling, and TLS-related issues underscores the complexity of securing modern email systems.