ACTIVELY EXPLOITED
CVE-2010-4345: Exim Privilege Escalation Vulnerability
| Vendor | Exim |
|---|---|
| Product | Exim |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Mar 2022 |
| CISA federal deadline | 15 Apr 2022 |
| Weakness (CWE) | CWE-264 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Exim allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate configuration file with a directive that contains arbitrary commands.
SOURCES
Other Exim flaws
- CVE-2010-4344: Exim Heap-Based Buffer Overflow Vulnerability
- CVE-2019-16928: Exim Out-of-bounds Write Vulnerability
- CVE-2019-10149: Exim Mail Transfer Agent (MTA) Improper Input Validation
- CVE-2018-6789: Exim Buffer Overflow Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.