External risk intelligence

Exim Heap-Based Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-67896

Exim is a widely used mail transfer agent (MTA) designed to be internet-facing for the purpose of receiving and relaying email. In standard deployments, it operates as an edge service listening on public-facing network ports to accept incoming mail connections from across the internet.

Buffer Overflow

Exim

before 4.99.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Exim, a widely used mail transfer agent. The issue, specifically a heap-based buffer overflow, arises from how certain non-default configurations handle database records without proper validation, potentially allowing remote attackers to impact system stability and data integrity. The main concern is confirming relevance and exposure.

Exim mail server has a critical flaw.
Attackers could disrupt mail services.
Verify if your Exim configuration is exposed.

Attack Path

How an attacker could exploit the issue

A remote attacker could send specially crafted data to an Exim server with a non-default rate-limit configuration. This data would be processed without proper validation, leading to a heap-based buffer overflow. Successful exploitation could allow an attacker to impact the confidentiality, integrity, and availability of the server.

No special access required.
Triggered by sending crafted data.
Leads to system compromise.

Live Threat

Current exploitation, exposure, and threat context

When configured with specific non-default rate limits, Exim could be vulnerable to a heap-based buffer overflow, potentially impacting the integrity and availability of the mail transfer service. This occurs because database records are directly cast into internal structures without proper validation.

Mail transfer service integrity and availability.
Remote attackers could trigger overflow.
Service disruption or unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Exim mail transfer agent, when configured with specific rate limits, presents a critical remote heap-based buffer overflow vulnerability. Given Exim's typical role as an internet-facing service for email delivery, infrastructure and platform teams managing mail servers are likely responsible for addressing this. The immediate practical step is to inventory all Exim instances, determine their exposure and criticality, identify the accountable owner, and then plan remediation during a maintenance window.

Own by infrastructure or platform teams.
Verify Exim instances and exposure.
Plan Exim updates in maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Exim and how is it used?

Exim is a widely used mail transfer agent (MTA). It functions as a server-side application responsible for receiving, routing, and delivering email across networks. Organizations deploy it as an edge service, meaning it is typically configured to listen on public network ports to handle incoming mail traffic from the internet, acting as the primary gateway for an organization's email infrastructure.

What does heap-based buffer overflow mean in CVE-2025-67896?

This CVE involves a weakness classified as CWE-122 (Heap-based Buffer Overflow). In plain terms, the software fails to properly check the size or content of incoming database records before storing them in memory. By sending specially crafted data, an attacker can overflow the allocated memory space, which may lead to system crashes or potentially allow unauthorized execution of commands.

How is this vulnerability triggered?

A remote attacker triggers this flaw by sending specifically crafted data to an Exim server. The vulnerability specifically requires the use of certain non-default rate-limit configurations. If your Exim instance is not utilizing these specific rate-limiting features, or if the incoming data does not match the crafted format designed to exploit the missing validation, the overflow condition is not met.

Who should be concerned about CVE-2025-67896?

Anyone running Exim instances should investigate their exposure. According to Halo Surface Signal, Exim is inherently designed to be internet-facing to relay email, which often places it on the network edge. Because this flaw is remotely exploitable without requiring special access, any server reachable from the internet that uses the affected rate-limiting configuration is at higher risk.

How do I respond to this Exim vulnerability?

First, conduct an inventory to identify all Exim instances in your environment. Check each instance to see if it uses the vulnerable non-default rate-limit settings. Once you have identified affected servers, coordinate with your infrastructure or platform teams to plan an update. The goal is to reach a secure version as soon as a maintenance window allows to mitigate the risk of system compromise.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.