CVE-2026-94054: 
Exim vulnerability analysis and mitigation

CVE-2026-94054 is an out-of-bounds write vulnerability in Exim, the widely-used open-source mail transfer agent, triggered when the Proxy-Protocol feature is used with an attacker-controlled proxy. It affects Exim versions 4.83 through 4.100.0 (i.e., before 4.100.1). The vulnerability was published on September 19, 2026, with a patch released in version 4.100.1. It carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), occurring in Exim's Proxy-Protocol handling code when processing data from a proxy server that an attacker controls. When Proxy-Protocol is enabled, Exim trusts and processes proxy-supplied connection metadata; insufficient bounds checking allows an attacker-controlled proxy to supply crafted data that causes Exim to write beyond the intended buffer boundary. Exploitation requires high attack complexity (network-based, no privileges or user interaction needed), as the attacker must be in a position to control or impersonate a proxy server that Exim is configured to accept (GitHub Advisory, Exim Mailing List).

Successful exploitation can result in memory corruption that may lead to arbitrary code execution on the Exim server, exposure of sensitive data (low confidentiality impact), high-integrity compromise of the mail server, and potential service disruption (low availability impact). Because Exim typically runs with elevated privileges and handles all inbound email, a compromised instance could expose email content, credentials, and allow an attacker to pivot further into the internal network (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2026-94054. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or compromise a proxy server that the target Exim instance is configured to trust via Proxy-Protocol, which raises the practical bar for exploitation (GitHub Advisory).

Upgrade Exim to version 4.100.1 or later, which contains the fix for this vulnerability. As interim mitigations, restrict Proxy-Protocol connections to only explicitly trusted and verified proxy sources using Exim's hosts_proxy configuration directive, or disable Proxy-Protocol support entirely if it is not required for your deployment. Review firewall rules to ensure that only legitimate proxy hosts can establish connections to the Exim listener (GitHub Advisory, Exim Mailing List).