# CVE-2018-6789: Exim Buffer Overflow Vulnerability

Source: https://junglewise.ai/threats/cve-2018-6789-exim-buffer-overflow-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2018-6789 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

Exim contains a buffer overflow vulnerability in the base64d function of its SMTP listener. By sending a handcrafted message, a remote attacker can trigger the overflow to execute arbitrary code.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2018-6789 exploited in the wild?** Yes. CVE-2018-6789 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2018-6789?** Critical severity, with a CVSS score of 9.8, published 3 November 2021.

**Which products and versions are affected?** Exim Exim before 4.90.1; Canonical Ubuntu Linux 14.04, 16.04, 17.10; Debian Debian Linux.

**Is there a fix for CVE-2018-6789?** A patch was published on 2018-02-05: Patch committed to Exim git repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-6789 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2018-6789?** Check whether you run Exim. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Exim Exim before 4.90.1
- Canonical Ubuntu Linux 14.04, 16.04, 17.10
- Debian Debian Linux

## Timeline

- 2018-02-05: patched: Patch committed to Exim git repository.
- 2018-02-07: disclosed: Initial disclosure on OSS-security mailing list.
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.

## Related threats

- [Exim SMTP smuggling in DATA phase rejection handling](https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received)
- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim out-of-bounds write in Proxy Protocol v1](https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim privilege escalation in .forward pipe transport force_command](https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command)