PT-2026-44997 · Exim+2 · Exim+2
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Exim versions 4.88 through 4.99.3
Description
In certain proxy configurations where
SUPPORT PROXY is enabled, the PROXY protocol parser mishandles short payloads before SMTP authentication. This leads to a pre-authentication information disclosure where uninitialized stack memory values, specifically 16 bytes containing live userspace virtual address (VA) pointers, are leaked to the client within the IPv6 address information of the SMTP Hello header. This leak can be used as a primitive to defeat Address Space Layout Randomization (ASLR), potentially facilitating the exploitation of other vulnerabilities by revealing the memory layout.Recommendations
Update Exim to version 4.99.4.
As a temporary mitigation, disable the
SUPPORT PROXY option or restrict the use of the PROXY protocol if not required.Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Exim
Linuxmint
Ubuntu