Exim’s Poisoned Record: How a Failed Patch and SQL Injection Lead to Critical Heap Overflows

According to the National Institute of Standards and Technology (NIST), two critical Exim vulnerabilities were disclosed in Exim version 4.99, exposing a patched hole that could be exploited via SQLite integration to corrupt memory and seize server control. Fasano noted that a recent fix for CVE-2025-26794—a SQL injection vulnerability involving ETRN commands—did not fully address the underlying root cause in the xtextencode() function, which still fails to properly escape single quote characters.

The flaws can be chained through Ratelimit ACLs by sending a crafted email with a malicious sender address, enabling an attacker to inject arbitrary SQL commands into the database and trigger a heap buffer overflow. The overflow occurs when the system reads the bloom_size field from the database without validation, potentially writing far past the allocated buffer and overwriting up to 1.5MB of memory, with full RCE not yet demonstrated.

The vulnerability is tracked as CVE-2025-67896, and a “perfect storm” of configurations—USE_SQLITE=yes and ratelimits keyed to attacker-controlled data—is required for exploitation. Administrators running Exim 4.99 with SQLite should upgrade to the latest version. Dec 22, 2025.