Exim 4.100.1 Patches 4 Vulnerabilities, Including SMTP Smuggling and Heap Corruption

Key Takeaways

• Exim has released version 4.100.1 to address four security vulnerabilities.
• Two high-severity flaws impact Exim’s Proxy Protocol handling, potentially leading to heap corruption or information disclosure.
• A medium-severity SMTP smuggling vulnerability could allow attackers to alter email content without sender logging.
• A low-severity use-after-free bug in GnuTLS handling could crash mail reception processes.
• Administrators are urged to upgrade immediately to mitigate risks across a wide range of Exim versions.

Exim, a widely used mail transfer agent, has released a critical update, version 4.100.1, to patch four distinct security vulnerabilities. These flaws range in severity, including high-impact issues related to Proxy Protocol handling, a medium-severity SMTP smuggling exploit, and a low-severity use-after-free bug.

The security bulletin, issued on September 18, 2026, emphasizes that these vulnerabilities affect a broad spectrum of Exim deployments, with some configurations vulnerable as far back as version 4.83. System administrators are strongly advised to prioritize upgrading to Exim 4.100.1 to protect their mail servers.

High-Severity Proxy Protocol Vulnerabilities

Among the most critical issues addressed is GCVE-25-2026-09-50-1, a heap corruption vulnerability impacting Exim installations configured to utilize Proxy Protocol version 1. This flaw manifests as an out-of-bounds write, where a remote attacker could trigger a read of approximately 230 bytes beyond a heap allocation boundary, followed by a single NUL-byte write at the end of that read.

This particular bug affects Exim versions 4.83 through 4.100 when Proxy Protocol support is enabled and the server receives data from a compromised or faulty proxy. Heap corruption vulnerabilities are serious, as they can lead to unpredictable process behavior, service crashes, or, depending on memory layout and system protections, more severe security compromises. Exim 4.100.1 rectifies this by refining the data-read sizing logic.

A second high-severity vulnerability, GCVE-25-2026-09-55-1, also pertains to Proxy Protocol handling, specifically version 2. Discovered and reported by security researcher McCaulay Hudson of watchTowr, this flaw stems from the use of uninitialized data. A remote attacker could exploit this condition to transmit sensitive stack data from the Exim server.

This vulnerability is present in Exim versions 4.83 through 4.100 when Proxy Protocol is active and a configured proxy is either malfunctioning or compromised. The update addresses this by modifying how Exim processes the Proxy Protocol header, ensuring that the complete header is received through repeated reads before any data is processed, preventing the handling of incomplete or malicious input.

SMTP Smuggling and GnuTLS Use-After-Free

Exim 4.100.1 also resolves GCVE-25-2026-09-56-1, a medium-severity SMTP smuggling vulnerability affecting all Exim versions up to and including 4.100. This issue, also reported by McCaulay Hudson, could allow an attacker to manipulate an email submission such that the message processed by the mail server differs from what was originally sent and logged by the originating system.

The attack scenario involves Exim rejecting a message during the SMTP data phase, while the attacker simultaneously injects specially crafted content after the rejection point. Exim noted that while standard processing rules still apply to the “smuggled” message, this behavior creates significant concerns regarding message integrity and logging discrepancies, as the mail server processes content not reflected in sender records.

The updated version 4.100.1 mitigates this by enhancing the detection of the SMTP data phase’s conclusion following a rejection, ensuring that no unauthorized content is processed. Additionally, the release fixes GCVE-25-2026-09-51-1, a low-severity use-after-free flaw within GnuTLS TLS-on-connect handling.

This vulnerability affects Exim versions 4.98 through 4.100 when compiled with GnuTLS 3.6.4 or newer. Exploitation requires the non-default tls_early_banner_hosts setting to be enabled. An attacker could leverage this condition to trigger a use-after-free, potentially leading to a crash of the mail reception process. For organizations unable to upgrade immediately, disabling tls_early_banner_hosts can reduce exposure. The new version alters program control flow to prevent the use of freed memory.

What You Should Do

• Upgrade Immediately: All Exim administrators should upgrade their mail servers to version 4.100.1 as soon as possible.
• Verify Downloads: Obtain the signed release from official Exim distribution channels and verify package checksums and signatures to ensure integrity.
• Review Proxy Configurations: If using Proxy Protocol, ensure your proxy infrastructure is secure and properly configured.
• Consider Mitigation for GnuTLS: If immediate upgrade is not feasible and you are running vulnerable GnuTLS versions, disable the tls_early_banner_hosts setting to reduce exposure to the use-after-free vulnerability.
• Monitor Logs: Pay close attention to mail server logs for any unusual activity or discrepancies in message processing.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.