Executive brief
Exim, a widely used mail transfer agent, contains a vulnerability in how it handles certain proxy connection requests. An attacker can send a specially crafted message that causes the server to reveal small pieces of its internal memory in its response. While this does not directly allow for full system takeover, the leaked information can help attackers bypass security protections like ASLR to facilitate more complex subsequent attacks.
Technical details
An information disclosure vulnerability exists in Exim's proxy_protocol() function when handling PROXYv2 frames. The function fails to perform a minimum-length check on incoming frames before accessing an uninitialized stack union. By sending a frame with a specific address family (e.g., TCPv6 0x21) and a length of zero, an attacker can bypass the read loop, causing the server to copy 16 bytes of uninitialized stack memory into the sender_host_address variable. This leaked data is then emitted in the SMTP greeting banner. This vulnerability can be used as an ASLR-defeat primitive because the leaked bytes often contain live userspace pointers. The issue affects configurations where SUPPORT_PROXY is enabled and hosts_proxy is configured.
Affected products
- Exim Exim 4.88 before 4.99.4
Timeline
- 2026-05-19: other: Vulnerability reported to Exim maintainers
- 2026-05-25: other: CVE-2026-48840 assigned by MITRE
- 2026-05-29: patched: Exim 4.99.4 released with fix
- 2026-05-30: advisory: NVD publication date