CVE-2025-67896
📋 TL;DR
A heap-based buffer overflow vulnerability in Exim mail servers with certain non-default rate-limit configurations allows remote attackers to potentially execute arbitrary code or cause denial of service. This affects Exim installations before version 4.99.1 that have specific rate-limiting database configurations enabled. Organizations running vulnerable Exim versions with custom rate-limiting setups are at risk.
💻 Affected Systems
- Exim
📦 What is this software?
Exim by Exim
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, mail server takeover, and lateral movement within the network.
Likely Case
Denial of service causing mail service disruption, potential information disclosure, or limited code execution in constrained contexts.
If Mitigated
Service disruption with limited impact if proper network segmentation and privilege separation are implemented.
🎯 Exploit Status
Exploitation requires specific non-default configurations. No public proof-of-concept available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.99.1
Vendor Advisory: https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
Restart Required: Yes
Instructions:
1. Download Exim 4.99.1 or later from exim.org. 2. Backup current configuration. 3. Stop Exim service. 4. Install new version following vendor instructions. 5. Restart Exim service.
🔧 Temporary Workarounds
Disable vulnerable rate-limit configurations
linuxRemove or disable non-default rate-limit database configurations that trigger the vulnerability
Review exim.conf for rate-limit settings
Comment out or remove problematic rate-limit database configurations
Network isolation
linuxRestrict network access to Exim service
iptables -A INPUT -p tcp --dport 25 -s trusted_networks -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor logs for exploitation attempts and implement intrusion detection
🔍 How to Verify
Check if Vulnerable:
Check Exim version and review configuration for non-default rate-limit database settingsCheck Version:
exim -bV | grep 'Exim version'Verify Fix Applied:
Verify Exim version is 4.99.1 or later and test mail functionality📡 Detection & Monitoring
Log Indicators:
- Unusual rate-limit database access patterns
- Exim process crashes or abnormal restarts
- Memory allocation errors in system logs
Network Indicators:
- Unusual SMTP traffic patterns targeting rate-limiting features
- Multiple connection attempts from single sources
SIEM Query:
source="exim.log" AND ("buffer overflow" OR "segmentation fault" OR "rate-limit" AND "database")