CVE-2026-94056

Received Received - Intake

Exim Proxy-Protocol Memory Disclosure Vulnerability

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: MITRE

Description

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-94056

Affected Vendors & Products

Vendor	Product	Version / Range
exim	exim	to 4.100.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-908	The product uses or accesses a resource that has not been initialized.

Attack-Flow Graph

Executive Summary

Exim before version 4.100.1 has a vulnerability when used with Proxy-Protocol and an attacker-controlled proxy. This allows attackers to read uninitialized stack memory data, potentially exposing sensitive information.

Impact Analysis

This vulnerability could allow attackers to access sensitive data stored in memory, such as passwords, encryption keys, or other confidential information processed by Exim. It may lead to data breaches or unauthorized access to system resources.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Exim to version 4.100.1 or later to address the vulnerability. Disable Proxy-Protocol if not required or restrict its use to trusted proxies only.

Hi! I’m here to help you understand CVE-2026-94056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70