Vulnerability record · CVE-2017-16943 · published 25 November 2017
CVE-2017-16943: Exim SMTP daemon use-after-free via BDAT commands
Exim · Exim
The receive_msg function in receive.c in the Exim SMTP daemon mishandles BDAT commands, leading to a use-after-free in Exim 4.88 and 4.89. A remote, unauthenticated attacker can trigger memory corruption that may result in arbitrary code execution or a denial of service.
Description
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network reachability, no authentication, high EPSS, and public exploit references make this a top remediation priority despite absence from KEV.
What it is
The receive_msg function in receive.c in the Exim SMTP daemon mishandles BDAT commands, leading to a use-after-free in Exim 4.88 and 4.89. A remote, unauthenticated attacker can trigger memory corruption that may result in arbitrary code execution or a denial of service.
Impact
Successful exploitation can give an attacker code execution in the context of the Exim process, or crash the daemon to disrupt mail service. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reachable over the network through the SMTP service by sending crafted BDAT commands; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is high at roughly 0.467 (98.8th percentile), and references include an Exim bug tracker entry and a public PoC mirror tagged as exploit.
What to do
- Upgrade Exim to a version containing the fixes referenced by the Exim git commits (4.88 and 4.89 are the affected versions named).
- Apply the vendor patch or distribution update (for example Debian DSA-4053) where upgrading is not immediately possible.
- Restrict SMTP access to trusted networks or hosts where feasible to reduce exposure of the daemon.
- Monitor Exim for crashes or abnormal process termination and treat repeated failures as a possible exploitation attempt.
Detection
- Review Exim logs for malformed or unusual BDAT command sequences and abrupt connection handling.
- Alert on Exim process crashes or restarts correlated with inbound SMTP sessions.
- Hunt for known public PoC traffic patterns against the SMTP port on internet-facing mail servers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-16943 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-16943), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
