CVE-2010-4344: Exim SMTP heap buffer overflow enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated remote code execution, CISA KEV listing and high EPSS probability make this an urgent patching priority.

What it is

Exim before 4.70 has a heap-based buffer overflow in string_vformat in string.c. A remote SMTP session that sends two MAIL commands plus a large message with crafted headers triggers improper rejection logging and memory corruption. It matters because the flaw is remotely reachable without authentication and can lead to arbitrary code execution on the mail server.

Impact

An unauthenticated remote attacker can corrupt heap memory and potentially execute arbitrary code with the privileges of the Exim process, typically root on many deployments. This can lead to full compromise of the mail server.

Attack surface

Reached over the network via SMTP; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user interaction is required. The attacker only needs to complete an SMTP session with two MAIL commands and a large crafted message.

Exploitation

CVE-2010-4344 is listed in CISA KEV with a 2022-03-25 addition date, and EPSS shows a 30-day probability of 0.71901 (99.396th percentile). References include an Exploit-tagged Exim lurker message, an Exploit-tagged Openwall post, and a Metasploit module, indicating public exploit tooling exists.

What to do

• Upgrade Exim to 4.70 or later, or apply the vendor patch referenced in the Exim bug and git commit.
• Apply distribution updates for Debian, Ubuntu, openSUSE and other affected packages per their advisories.
• Restrict SMTP access to trusted networks or hosts where feasible to reduce exposure.
• Monitor for and block exploit attempts targeting the two-MAIL-command pattern at the SMTP gateway.
• Verify the Exim version and patch level on all internet-facing mail servers.

Detection

• Inspect SMTP logs for sessions containing two MAIL commands followed by unusually large messages or malformed headers.
• Monitor Exim process crashes or abnormal termination and correlate with inbound SMTP sessions.
• Use network IDS signatures for the Exim string_vformat overflow pattern and known Metasploit module traffic.
• Alert on unexpected child processes or outbound connections originating from the Exim service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.