CVE-2025-67896: 
Exim vulnerability analysis and mitigation

CVE-2025-67896 is a heap-based buffer overflow vulnerability in the Exim mail transfer agent (MTA) affecting all versions before 4.99.1. The flaw exists specifically in Exim 4.99 when SQLite is used for lookups or hint databases, where SQL injection can lead to heap corruption because database records are cast directly to internal structures without validation. The vulnerability was disclosed via the oss-security mailing list on December 9–11, 2025, with CVE assignment confirmed on December 14, 2025, and the patched release (4.99.1) published on December 18, 2025 (oss-security, oss-security release). It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat).

The root cause is a heap-based buffer overflow (CWE-122) introduced in Exim 4.99, triggered via SQL injection in configurations that use SQLite for lookups or SQLite hint databases. Specifically, database records retrieved via SQLite are cast directly to internal Exim structures without proper validation, allowing an attacker to craft malicious input that corrupts heap memory. The attack vector is network-accessible (SMTP), requires no authentication or user interaction, and has low attack complexity — though it is conditional on the target Exim instance being built with SQLite support and configured to use SQLite lookups or hint DBs. The vulnerability was credited to Andrew Fasano, whose original report is documented in the Exim security advisory (oss-security release, Exim Security Advisory).

Successful exploitation can result in remote code execution on the affected mail server, with full confidentiality, integrity, and availability impact. An unauthenticated remote attacker can corrupt heap memory, potentially gaining control of the Exim process and the underlying system, enabling data exfiltration, email interception, or use of the server as a pivot point for lateral movement within the network. Because Exim is a widely deployed MTA typically exposed directly to the internet, the attack surface is significant (Red Hat, oss-security release).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Red Hat). The EPSS score is approximately 0.037%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the critical CVSS score, network accessibility, and the historical pattern of Exim vulnerabilities being rapidly weaponized make this a high-priority patching target.

1. Reconnaissance: Identify internet-facing Exim 4.99 instances using banner grabbing (e.g., via telnet <target> 25 or tools like Shodan/Censys). Confirm the Exim version from the SMTP greeting banner.
2. Verify SQLite support: Determine if the target Exim build includes SQLite support by checking exim -bV output for "Hints DB" (SQLite hint db) or "Lookups" containing SQLite. This information may be inferred from the distribution or configuration.
3. Craft SQL injection payload: Construct a malicious SMTP transaction or lookup input that injects SQL into the SQLite query path used by Exim's rate-limit or lookup configuration, causing a poisoned record to be stored or retrieved.
4. Trigger heap corruption: Send the crafted input to the target Exim server over SMTP (port 25 or 587). When Exim processes the SQLite record and casts it directly to an internal structure without validation, heap memory is corrupted.
5. Achieve code execution: Leverage the heap corruption to redirect execution flow, potentially spawning a reverse shell or executing arbitrary commands as the Exim service account (oss-security release, Exim Security Advisory).

• Network: Unusual or malformed SMTP connections from external IPs; unexpected outbound connections from the mail server to unknown hosts following SMTP activity.
• Logs: Exim panic log (/var/log/exim4/paniclog) entries indicating memory corruption or unexpected crashes; Exim main log showing anomalous lookup queries or SQL-related errors.
• Process: Unexpected child processes spawned by the Exim daemon (e.g., /bin/sh, bash, curl, wget); Exim process consuming abnormal memory.
• File System: New or modified files in Exim's spool or configuration directories; unexpected cron jobs or scripts created by the Debian-exim or exim service account.
• Database: Unexpected or malformed entries in SQLite hint databases used by Exim (e.g., ratelimit.db, callout.db).

Upgrade Exim to version 4.99.1 or later, which was released on December 18, 2025, and contains the fix for CVE-2025-67896 (oss-security release). Notably, Exim versions prior to 4.99 are reported to be unaffected (4.98.2 is considered safe), so the vulnerability is specific to the 4.99 branch. As a workaround, administrators can disable SQLite lookups and SQLite hint databases in their Exim configuration if upgrading immediately is not possible — verify exposure by running exim -bV and checking for "Hints DB" and SQLite in "Lookups". Network-level controls (e.g., restricting SMTP access to trusted sources) can reduce exposure until patching is complete (Exim Security Advisory).

The vulnerability was coordinated through the oss-security mailing list by Exim maintainer Heiko Schlittermann, with a structured disclosure timeline allowing distribution packagers early access before public release (oss-security). FINRA issued a cybersecurity alert regarding Exim mail vulnerabilities, highlighting the risk to financial sector organizations. Security Online Info published a technical write-up titled "Exim's Poisoned Record: How a Failed Patch and SQL Injection Lead to Critical Heap Overflows," providing additional context on the vulnerability chain (Security Online). The DirectAdmin community forum also discussed the security release, reflecting broad awareness among server administrators (DirectAdmin Forum).