A corrective release of the Exim mail server 4.99.1 has been published, which addresses a vulnerability (CVE-2025-67896) that allows a remote attacker to corrupt memory content outside of the allocated buffer. This issue could potentially be exploited for remote code execution on the server, although a working exploit has not yet been prepared.
The vulnerability exists in the code for working with the internal database (Hints DB) based on SQLite, used for storing temporary information, message delivery status, and details about the intensity of mail sending. The issue is caused by records from the database being directly converted into the internal structure "dbdata_ratelimit_unique" without proper validation. A situation arose where a fixed array "bloom" was created, sized at 40 bytes, and the content of the field "bloom_size," which defines the number of elements written to the array, depended on the size of the data in the database. An attacker could organize a write operation beyond the allocated buffer by placing data in the database (using another vulnerability) such that the field "bloom_size" assumed a value greater than the array size.
The problem manifests in Exim versions 4.99 and 4.98.2, and affects configurations with ACL ratelimit that use the "unique" or "per_addr" parameters (for example, "warn ratelimit = 100 / 1h / per_addr / $sender_address" or "warn ratelimit = 100 / 1h / per_rcpt / unique=$sender_address"). Additionally, for an attack to occur, Exim must be built with SQLite support (USE_SQLITE=yes), activated in the configuration file (hints_database = sqlite). In vulnerable configurations, running "exim -bV" outputs "Hints DB: Using sqlite3."
Among the major distributions, the problematic versions were used in Debian 13, Ubuntu 25.10, SUSE/openSUSE, Arch Linux, Fedora, and FreeBSD. RHEL and derivative distributions are not affected, as Exim is not included in their standard package repository (in EPEL, the update for the exim package has not yet been published).
There is also a noted identification of a new vector for exploiting the vulnerability CVE-2025-26794, which was fixed in the February release of Exim 4.98.1. This vulnerability allows for the injection of SQL code into the internal database (Hints DB). The previously added fix did not escape single quotes. An example of a MAIL FROM command that leads to SQL code injection is: "MAIL FROM:<"x’/**/UNION/**/SELECT/**/X'<hex_blob>’—"@attacker.com>". This vulnerability can serve as the initial link for creating the conditions for the aforementioned buffer overflow.
Source: opennet.ru
