CVE-2026-94055: 
Exim vulnerability analysis and mitigation

CVE-2026-94055 is a use-after-free vulnerability in Exim, the widely deployed open-source mail transfer agent, triggered when certain non-default TLS settings are used in conjunction with GnuTLS. It affects Exim versions from 4.98 up to (but not including) 4.100.1, and was published on September 19, 2026. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low), reflecting its high attack complexity and limited availability-only impact (GitHub Advisory, ENISA EUVD).

The root cause is a use-after-free condition (CWE-416) in Exim's TLS handling code when GnuTLS is used with specific non-default TLS configuration options. A use-after-free occurs when memory is freed but a dangling pointer to that memory is subsequently accessed, potentially causing undefined behavior. The vulnerability is network-reachable with no authentication or user interaction required, but exploitation requires high attack complexity, likely due to the need to trigger a precise memory state or race condition. The flaw was disclosed via the Exim mailing list on September 18, 2026 (Exim Mailing List, GitHub Advisory).

Successful exploitation of this vulnerability can cause the Exim mail service to crash, resulting in a denial of service (DoS) for email delivery. The CVSS scoring reflects only a low availability impact with no confidentiality or integrity impact, meaning data exfiltration and unauthorized modification are not expected outcomes. The scope is limited to the affected Exim instance, and lateral movement or data exposure are not primary concerns based on current analysis (GitHub Advisory, ENISA EUVD).

As of the time of disclosure, there are no known public proof-of-concept exploits and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for non-default TLS/GnuTLS configurations to be present on the target (GitHub Advisory, ENISA EUVD).

The primary remediation is to upgrade Exim to version 4.100.1 or later, which contains the fix for this use-after-free (GitHub Advisory). If immediate patching is not feasible, administrators should review their TLS configuration and avoid non-default GnuTLS settings that may trigger the vulnerable code path. As an additional measure, network-level access controls (e.g., firewall rules) can be used to restrict inbound TLS connections to trusted sources, reducing the attack surface until the patch can be applied (ENISA EUVD).