# CVE-2026-94054: Exim out-of-bounds write in Proxy Protocol v1

Source: https://junglewise.ai/threats/cve-2026-94054-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-94054 · Severity: high · CVSS 7 · Published 2026-09-19

Exim is a widely used mail transfer agent that processes incoming email. When configured to accept connections through a proxy using Proxy Protocol v1, a remote attacker controlling the proxy can trigger an out-of-bounds write on the heap, causing memory corruption that could lead to data exposure or system compromise.

Technologies: [Exim](https://junglewise.ai/threats/technologies/exim). Vendors: [Exim](https://junglewise.ai/threats/vendors/exim).

## Quick answers

**Is CVE-2026-94054 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-94054 being exploited in the wild.

**How severe is CVE-2026-94054?** High severity, with a CVSS score of 7, published 19 September 2026.

**Which products and versions are affected?** Exim 4.83 to 4.100, fixed in 4.100.1.

**Is there a fix for CVE-2026-94054?** A patch was published on 2026-09-18: Exim 4.100.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-94054 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-94054?** Check whether you run Exim at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds write vulnerability in Exim's Proxy Protocol v1 handling allows a remote attacker to write a NUL byte past the end of a heap allocation during packet processing. The vulnerability requires Exim to be built with Proxy Protocol support and configured to use it, and the proxy must be buggy or compromised. The fix properly sizes the data read operation to prevent the overflow.

## Affected products

- Exim Exim 4.83 to 4.100, fixed in 4.100.1

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Exim 4.100.1 released

## References

- [https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html](https://lists.exim.org/lurker/message/20260918.121220.0f87338e.en.html)

## Related threats

- [Exim SMTP smuggling in DATA phase rejection handling](https://junglewise.ai/threats/cve-2026-94057-exim-before-4-100-1-allows-smtp-smuggling-in-which-the-received)
- [Exim Proxy Protocol stack memory disclosure](https://junglewise.ai/threats/cve-2026-94056-exim-before-4-100-1-when-proxy-protocol-is-used-with-an-attacker)
- [Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.](https://junglewise.ai/threats/cve-2026-94055-exim-before-4-100-1-when-certain-non-default-tls-settings-are)
- [Exim privilege escalation in .forward pipe transport force_command](https://junglewise.ai/threats/cve-2026-66141-exim-privilege-escalation-in-forward-pipe-transport-force-command)
- [Exim directory traversal in queue-name arguments](https://junglewise.ai/threats/cve-2026-66140-exim-directory-traversal-in-queue-name-arguments)