Executive brief
Exim, a widely used mail transfer agent for Unix-like operating systems, contains a vulnerability that could allow a local user to gain elevated system privileges. By exploiting how the software handles user-defined mail forwarding rules, an attacker can execute commands with the permissions of a more privileged user. This could lead to a full system compromise or unauthorized access to sensitive data.
Technical details
A local privilege escalation vulnerability exists in Exim versions 4.82 through 4.99.4. The flaw occurs when a redirect router implements .forward facilities for local users and uses a pipe transport that has the 'force_command' option enabled. If the pipe transport is configured to run as a privileged user, a local attacker can use string expansion within their .forward file to manipulate command execution. This allows the attacker to execute arbitrary commands with the privileges of the user assigned to the pipe transport. The issue is resolved in version 4.99.5; a temporary mitigation is to disable the 'force_command' option on pipe transports.
Affected products
- Exim Exim 4.82 through 4.99.4
Timeline
- 2026-06-22: other: Report received by maintainers
- 2026-07-22: disclosed: Public release of advisory
- 2026-07-22: patched: Version 4.99.5 released
- 2026-07-24: advisory: NVD publication date