CVE-2026-66141

Published Jul 24, 2026

Last updated 21 days ago

CVSS high 7.4

Overview

Description: Exim before 4.99.5 allows .forward privilege escalation because force_command for a pipe transport is mishandled.
Source: cve@mitre.org
NVD status: Analyzed
Products: exim

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-829

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:exim:exim:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D6B38542-B049-4573-8932-7B78A8721AE4",
            "versionEndExcluding": "4.99.5",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.•CVE-2026-66140
Exim 4.88 before 4.99.4, in some proxy configurations, mishandles certain short payloads, leading to disclosure of uninitialized stack memory values to a client.•CVE-2026-48840
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered when a client sends a TLS close_notify mid-body during a CHUNKING transfer, followed by a final cleartext byte on the same TCP connection. This can lead to heap corruption. An unauthenticated network attacker exploiting this vulnerability could execute arbitrary code.•CVE-2026-45185
In Exim before 4.99.2, when the SPA authentication driver is used with an adversarial SPA resource, there can be an out-of-bounds write that crashes the connection instance, or erroneous data processing that divulges data from uninitialized heap memory.•CVE-2026-40687
In Exim before 4.99.2, when utf8 operators are enabled, there is an out-of-bounds read if large UTF-8 trailing characters are present (malformed UTF-8 header data). Information might be divulged within an error message produced during handling of an unrelated e-mail message.•CVE-2026-40686

References

Sources include official advisories and independent security research.

https://nvd.nist.gov/vuln/detail/CVE-2026-66141
https://openwall.com/lists/oss-security/2026/07/22/9

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References