Live › vulnerability › CVE-2010-4344
Go to dashboardHeap overflow in Exim string_vformat(), fixed in 4.70 (Nov 2009) but not flagged as security at the time. Remote unauthenticated attacker sends an SMTP session with crafted headers on a rejected message; the default config logs rejected headers, which overflows the log buffer and corrupts the MAIL FROM ACL. A second MAIL FROM on the same connection then runs attacker ${run} commands as the Exim user. Chained with CVE-2010-4345 this gives root. Exploited in the wild since Dec 2010.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Exim Exim | vendor | – | – |
| Exim | vendor | < 4.70 | 4.70, 4.73 |
exim -bV (or exim4 -bV) and read the version line: anything below 4.70 is vulnerablelog_selector = -rejected_header, which blocks the known exploit path but not the underlying bugEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.
This page as .md · .json · in your agent: get_signal("CVE-2010-4344")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.