The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• exim exim4.88
• exim exim4.89

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2019-10149A flaw was found in Exim versions 4.87 to 4.91 (inclusive).KEV
  99Now
• CVE-2018-6789An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1.KEV
  94Now
• CVE-2010-4344Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code KEV
  91Now
• CVE-2019-16928Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846.KEV
  81Now
• CVE-2010-4345Exim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate confiKEV
  66This week
• CVE-2025-26794Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.
  62This week

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.