CVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validation

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-01-10
EPSS: 100.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-06-05 · updated 2026-06-17
Weakness: CWE-78

Description

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

Affected products

Canonical Ubuntu Linux: 18.04, 18.10
Debian Linux: 9.0
Exim: from 4.87 through 4.91

References

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00020.html
http://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html
http://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
http://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
http://seclists.org/fulldisclosure/2019/Jun/16
http://www.openwall.com/lists/oss-security/2019/06/05/2
http://www.openwall.com/lists/oss-security/2019/06/05/3
http://www.openwall.com/lists/oss-security/2019/06/05/4
http://www.openwall.com/lists/oss-security/2019/06/06/1
http://www.openwall.com/lists/oss-security/2019/07/25/6
http://www.openwall.com/lists/oss-security/2019/07/25/7
http://www.openwall.com/lists/oss-security/2019/07/26/4

Get alerted when CVE-2019-10149 or the next vulnerability affects your stack