{"id":"CVE-2010-4344","kind":"vulnerability","aliases":["CVE-2010-4344"],"related":[],"title":"Exim Exim: Exim Heap-Based Buffer Overflow Vulnerability","description":"Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.","summary":"Heap overflow in Exim string_vformat(), fixed in 4.70 (Nov 2009) but not flagged as security at the time. Remote unauthenticated attacker sends an SMTP session with crafted headers on a rejected message; the default config logs rejected headers, which overflows the log buffer and corrupts the MAIL FROM ACL. A second MAIL FROM on the same connection then runs attacker ${run} commands as the Exim user. Chained with CVE-2010-4345 this gives root. Exploited in the wild since Dec 2010.","severity":"critical","cvss":9.8,"epss":0.71706,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Exim Exim","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Exim","fixed":["4.70","4.73"],"affected":"< 4.70","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exim","exploited","mail-server","runtime","self-hosted","smtp"],"not_affected_if":["exim-4.70-or-later","managed-hosting"],"how_to_check":"Run 'exim -bV' (or 'exim4 -bV') and read the version line: anything below 4.70 is vulnerable. On Debian/Ubuntu also check the package build: exim4 4.69-9 on Lenny is vulnerable, 4.69-11ubuntu4.1 (karmic) and 4.69-2ubuntu0.2 (hardy) are backported fixes. Mitigated if log_selector contains -rejected_header.","fix":"Upgrade to Exim 4.73 or later (Exim recommendation; 4.70 contains the fix for this CVE alone). Distro packages with backported patches are fine, for example Debian Lenny security update or Ubuntu 4.69-11ubuntu4.1. Stopgap only: set 'log_selector = -rejected_header', which blocks the known exploit path but not the underlying bug. Also build with ALT_CONFIG_ROOT_ONLY to block the CVE-2010-4345 root escalation.","status":"open","published_at":"2010-12-14T16:00:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:04+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T21:22:04Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Exim to 4.70 or later, per the vendor instructions referenced by CISA.","reach":"internet","impact":"high","summary":"Exim, a widely used mail transfer agent, has a heap buffer overflow in its string_vformat function that is reachable over SMTP. A remote attacker can run arbitrary code on the mail server.","category":"runtime","who_cares":["exim","self-hosted","mail-server"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker executes arbitrary code on the mail server via SMTP","analyst_note":"Confirm the exact affected Exim version range and a version-check command from the vendor advisory; the sources only say before 4.70.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","exim-4.70-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2832,"output_tokens":335,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the exact affected Exim version range and a version-check command from the vendor advisory; the sources only say before 4.70.","search":"'-2010':11A,14A,99B '-4344':12A,15A '-4345':100B '2009':39B '2010':110B '4.70':37B,126C 'acl':78B 'allow':127C 'arbitrari':132C 'attack':50B,89B,129C 'base':6A,113C 'buffer':7A,72B,114C 'chain':96B 'code':133C 'command':91B,142C 'config':64B 'conjunct':144C 'connect':86B 'contain':149C 'corrupt':74B 'craft':56B,150C 'cve':10A,13A,98B 'dec':109B 'default':63B 'execut':131C 'exim':1A,2A,3A,16A,17A,18A,19B,32B,94B,124C 'exploit':20B,104B 'fix':35B 'flag':42B 'function':120C 'give':102B 'header':57B,67B,151C 'heap':5A,29B,112C 'heap-bas':4A,111C 'host':27B 'improp':154C 'includ':139C 'larg':147C 'lead':152C 'log':65B,71B,156C 'mail':22B,76B,81B,141C 'mail-serv':21B 'messag':61B,148C 'nov':38B 'overflow':8A,30B,69B,115C 'reject':60B,66B,155C 'remot':48B,128C 'root':103B 'run':88B,90B 'runtim':24B 'second':80B 'secur':44B 'self':26B 'self-host':25B 'send':51B 'server':23B 'session':54B,137C 'sinc':108B 'smtp':28B,53B,136C 'string':33B,118C 'string.c':122C 'time':47B 'two':140C 'unauthent':49B 'user':95B 'vformat':34B,119C 'via':134C 'vulner':9A 'wild':107B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2010-12-14T16:00:04+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-4344","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-4344","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2010-4344","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-4344","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2010-4344:62","url":null,"severity":null,"published_at":"2026-10-23T21:22:38+00:00","modified_at":"2026-10-23T21:22:38+00:00","first_seen_at":"2026-10-23T21:22:38+00:00","fetched_at":"2026-10-23T21:22:38+00:00","note":"Exim team post (exim-dev, 2010-12-10) confirms bug fixed in 4.70 (bug 787, commit 24c929a2), exploited in the wild vs Debian 4.69; 4.73 notes recommend 4.73 (also fixes CVE-2010-4345 root escalation). Ubuntu notes public exploit 2010-12-10. Affected range read as < 4.70 (no lower bound stated)."},{"source":"nvd","external_id":"CVE-2010-4344","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-4344","severity":null,"published_at":"2010-12-14T16:00:04+00:00","modified_at":"2026-06-16T23:24:36+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":960,"url":"https://alioth-lists.debian.net/pipermail/pkg-exim4-maintainers/2010-December/009993.html","title":"[exim-dev] Remote root vulnerability in Exim (Woodhouse, Exim team)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":961,"url":"https://code.exim.org/exim/wiki/wiki/Exim473ReleaseNotes","title":"Exim 4.73 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":962,"url":"https://kb.cert.org/vuls/id/682457","title":"VU#682457 Exim string_format() buffer overflow","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":963,"url":"https://ubuntu.com/security/CVE-2010-4344","title":"Ubuntu CVE-2010-4344","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}