CVE-2026-94056: 
Exim vulnerability analysis and mitigation

CVE-2026-94056 is a memory disclosure vulnerability in Exim, the widely-used open-source mail transfer agent, affecting versions 4.83 through before 4.100.1. When Proxy-Protocol is enabled and an attacker controls a proxy, the flaw allows unauthenticated network attackers to read uninitialized data from stack memory. The vulnerability was published on September 19, 2026, with a patch released the following day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-908 (Use of Uninitialized Resource): Exim's Proxy-Protocol handling reads or exposes stack memory that has not been properly initialized before use. An attacker who controls a proxy communicating with an Exim instance configured to accept Proxy-Protocol connections can craft protocol messages that cause the server to return or leak portions of uninitialized stack memory. Exploitation requires high attack complexity (e.g., the attacker must control or intercept a proxy connection), but no privileges or user interaction are needed, and the scope is changed — meaning the impact can extend beyond the Exim process itself (GitHub Advisory, Exim Mailing List).

Successful exploitation can expose sensitive data resident in the Exim process's stack memory, potentially including credentials, session tokens, encryption keys, or other confidential information processed by the mail server. There is no integrity impact, but a low availability impact is noted alongside the high confidentiality impact. The changed scope indicates that leaked data could affect components or systems beyond the Exim process itself, increasing the risk of downstream compromise (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or position themselves as a proxy communicating with a Proxy-Protocol-enabled Exim instance, which raises the practical bar for exploitation.

1. Reconnaissance: Identify Exim mail servers (versions 4.83–4.100.0) that have Proxy-Protocol support enabled, using banner grabbing, Shodan, or Censys queries targeting SMTP services.
2. Establish proxy control: Position an attacker-controlled system as a proxy that the target Exim instance is configured to accept Proxy-Protocol connections from (e.g., by compromising a load balancer, exploiting misconfigured trusted proxy lists, or via a man-in-the-middle position).
3. Craft malicious Proxy-Protocol header: Send a specially crafted Proxy-Protocol header (v1 or v2) to the Exim SMTP listener that triggers the uninitialized memory read — for example, by providing malformed or truncated protocol fields that cause Exim to process uninitialized stack data.
4. Capture leaked memory: Observe the server's response or error output for fragments of uninitialized stack memory, which may contain credentials, encryption keys, or other sensitive data previously processed by the Exim process.
5. Analyze and exploit leaked data: Parse the captured memory fragments for actionable secrets (e.g., TLS private key material, authentication credentials) to enable further attacks (GitHub Advisory, Exim Mailing List).

• Network: Unexpected or anomalous SMTP connections originating from untrusted proxy IP addresses to Exim servers with Proxy-Protocol enabled; unusual Proxy-Protocol headers (malformed, truncated, or with unexpected address fields) in SMTP session logs.
• Logs: Exim mainlog or paniclog entries showing errors or warnings related to Proxy-Protocol header parsing; repeated connection attempts from the same proxy IP with varying Proxy-Protocol header formats.
• Process: Exim process exhibiting unexpected memory access patterns or crashes (segmentation faults) potentially logged in system logs (/var/log/syslog, /var/log/mail.log) following malformed Proxy-Protocol input.

The primary remediation is to upgrade Exim to version 4.100.1 or later, which contains the fix for this vulnerability (GitHub Advisory, Exim Mailing List). If immediate patching is not feasible, administrators should disable Proxy-Protocol support in the Exim configuration or restrict proxy connections to explicitly trusted, controlled IP addresses using firewall rules or Exim's hosts_proxy ACL option. Monitoring proxy connection sources and auditing Exim configurations for unnecessary Proxy-Protocol exposure is also recommended.