# CVE-2026-48840: Exim stack memory disclosure in PROXY protocol handling

Source: https://junglewise.ai/threats/cve-2026-48840-exim-stack-memory-disclosure-in-proxy-protocol-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-30. Updated: 2026-05-30  
License: CC BY 4.0 with a link back

CVE-2026-48840 · Severity: medium · CVSS 5.3 · Published 2026-05-30

Exim, a widely used mail transfer agent, contains a vulnerability in how it handles certain proxy connection requests. An attacker can send a specially crafted message that causes the server to reveal small pieces of its internal memory in its response. While this does not directly allow for full system takeover, the leaked information can help attackers bypass security protections like ASLR to facilitate more complex subsequent attacks.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2026-48840 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48840 being exploited in the wild.

**How severe is CVE-2026-48840?** Medium severity, with a CVSS score of 5.3, published 30 May 2026.

**Which products and versions are affected?** Exim 4.88 before 4.99.4.

**Is there a fix for CVE-2026-48840?** A patch was published on 2026-05-29: Exim 4.99.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48840 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48840?** Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Exim's proxy_protocol() function when handling PROXYv2 frames. The function fails to perform a minimum-length check on incoming frames before accessing an uninitialized stack union. By sending a frame with a specific address family (e.g., TCPv6 0x21) and a length of zero, an attacker can bypass the read loop, causing the server to copy 16 bytes of uninitialized stack memory into the sender_host_address variable. This leaked data is then emitted in the SMTP greeting banner. This vulnerability can be used as an ASLR-defeat primitive because the leaked bytes often contain live userspace pointers. The issue affects configurations where SUPPORT_PROXY is enabled and hosts_proxy is configured.

## Affected products

- Exim Exim 4.88 before 4.99.4

## Timeline

- 2026-05-19: other: Vulnerability reported to Exim maintainers
- 2026-05-25: other: CVE-2026-48840 assigned by MITRE
- 2026-05-29: patched: Exim 4.99.4 released with fix
- 2026-05-30: advisory: NVD publication date

## References

- [https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1](https://exim.org/static/doc/security/EXIM-Security-2026-05-19.1)
- [https://www.openwall.com/lists/oss-security/2026/05/29/3](https://www.openwall.com/lists/oss-security/2026/05/29/3)

## Related threats

- [Exim SMTP smuggling in DATA phase rejection handling](https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received)
- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim out-of-bounds write in Proxy Protocol v1](https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim privilege escalation in .forward pipe transport force_command](https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command)