Vulnerability record · CVE-2017-16944 · published 25 November 2017
CVE-2017-16944: Exim SMTP daemon BDAT handling causes infinite loop and stack exhaustion
Exim · Exim
The receive_msg function in receive.c in the Exim SMTP daemon mishandles BDAT commands because it fails to properly check for the '.' character that marks the end of content, leading to an infinite loop and stack exhaustion. Exim 4.88 and 4.89 are affected. Because Exim is a widely deployed mail transfer agent, a remote unauthenticated attacker can repeatedly crash or hang the daemon, disrupting mail service.
Description
The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the content, related to the bdat_getc function.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote unauthenticated availability-only denial of service with a high EPSS score and public exploit references, though not listed in KEV.
What it is
The receive_msg function in receive.c in the Exim SMTP daemon mishandles BDAT commands because it fails to properly check for the '.' character that marks the end of content, leading to an infinite loop and stack exhaustion. Exim 4.88 and 4.89 are affected. Because Exim is a widely deployed mail transfer agent, a remote unauthenticated attacker can repeatedly crash or hang the daemon, disrupting mail service.
Impact
An attacker gains a denial of service: the SMTP daemon enters an infinite loop and exhausts its stack, making the mail service unavailable. There is no evidence in the record of confidentiality or integrity impact, and the CVSS vector confirms availability-only impact.
Attack surface
Reachable remotely over the network through SMTP BDAT commands, with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any host exposing the Exim SMTP listener is a potential target.
Exploitation
The record is not listed in CISA KEV, but EPSS is high at 0.6332 (99.17th percentile), and references include an Exploit-tagged Exim bug report and an Exploit-DB entry, indicating public exploit material exists.
What to do
- Upgrade Exim to a version later than 4.89 that contains the fix for the BDAT end-of-content handling.
- Apply the vendor patch referenced in the Exim bug report and Debian DSA-4053 if upgrading immediately is not possible.
- Restrict SMTP access to trusted networks or hosts where feasible to reduce exposure of the listener.
- Monitor and rate-limit inbound SMTP connections to limit the impact of repeated BDAT abuse.
Detection
- Monitor Exim process CPU and memory for sustained spikes or stack exhaustion correlated with SMTP sessions.
- Inspect SMTP logs for BDAT command sequences, especially repeated or malformed BDAT chunks without proper end-of-content termination.
- Alert on Exim daemon restarts, crashes, or unresponsive SMTP listeners that coincide with inbound BDAT traffic.
- Use network monitoring to flag unusually long-lived SMTP sessions issuing BDAT commands.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-16944 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-16944), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
