EXIM released version 4.100.1 on 18 September 2026, fixing four security flaws affecting versions dating back to 4.83. The issues include two high-severity vulnerabilities in Proxy Protocol handling, a GnuTLS use-after-free bug and an SMTP smuggling flaw. The highest-rated issue, CVE-2026-94056, has a CVSS v3 score of 7.5, while CVE-2026-94054 is rated 7.0, CVE-2026-94057 is rated 4.0 and CVE-2026-94055 is described as low severity. Exim maintainers reported no exploitation in the wild and no confirmed public proof-of-concept at the time of writing.
CVE-2026-94054 can cause a remote read of about 230 bytes beyond a heap allocation and a one-byte NUL write, while CVE-2026-94056 can disclose uninitialised stack data. Both require Exim to sit behind a buggy or compromised proxy using Proxy Protocol. CVE-2026-94055 can crash a receiving process, but only with GnuTLS and the non-default TLS-on-connect configuration. CVE-2026-94057 allows crafted data placed after a rejection during the SMTP DATA phase to create a message different from the one recorded by the sender.
The Proxy Protocol and SMTP smuggling flaws affect Exim 4.83 through 4.100; the GnuTLS issue affects 4.98 through 4.100. Administrators are advised to upgrade to 4.100.1. Three flaws have no workaround, while disabling the non-default `tls_early_banner_hosts` option provides a temporary mitigation for the GnuTLS issue.