high7.0
CVE-2025-67896
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly t…
Impact
Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Exim | Exim | before 4.99.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://exim.org/static/doc/security/
- https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
- https://www.openwall.com/lists/oss-security/2025/12/11/2
- http://www.openwall.com/lists/oss-security/2025/12/14/1
- http://www.openwall.com/lists/oss-security/2025/12/18/3