CVE-2025-67896

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-25)

CWE

CWE-122

Published

2025-12-14

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• exim:exim

References

• https://exim.org/static/doc/security/
• https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt
• https://www.openwall.com/lists/oss-security/2025/12/11/2
• http://www.openwall.com/lists/oss-security/2025/12/14/1
• http://www.openwall.com/lists/oss-security/2025/12/18/3

Check your stackJSON