Vulnerability record · CVE-2019-16928 · published 27 September 2019
CVE-2019-16928: Exim heap buffer overflow in string_vformat via long EHLO command
Exim · Exim
Exim 4.92 through 4.92.2 contains a heap-based buffer overflow in string_vformat in string.c triggered by a long EHLO command, allowing remote code execution. It is distinct from CVE-2019-15846. Because Exim is an internet-facing mail transfer agent, an unauthenticated remote attacker can reach the flaw directly over SMTP.
Description
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with network, unauthenticated, no-interaction reachability, confirmed KEV listing and high EPSS probability make this an urgent patch target.
What it is
Exim 4.92 through 4.92.2 contains a heap-based buffer overflow in string_vformat in string.c triggered by a long EHLO command, allowing remote code execution. It is distinct from CVE-2019-15846. Because Exim is an internet-facing mail transfer agent, an unauthenticated remote attacker can reach the flaw directly over SMTP.
Impact
An attacker can corrupt heap memory and execute arbitrary code with the privileges of the Exim process, typically the mail server user, potentially leading to full host compromise. No confidentiality, integrity or availability impact is excluded by the CVSS vector.
Attack surface
Reached over the network via SMTP by sending a crafted long EHLO command; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication and no user interaction are required. Any Exim 4.92 to 4.92.2 listener exposed to untrusted clients is in scope.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2022-03-03 with a 2022-03-17 remediation due date, and EPSS gives a 30-day probability of 0.41638 (98.6th percentile). Multiple references are tagged Exploit, indicating public exploit material exists; no ransomware campaign use is documented.
What to do
- Upgrade Exim to a version later than 4.92.2 that contains the fix in commit 478effbfd9c3cc5a627fc671d4bf94d13670d65f, or apply the vendor patch for your distribution.
- Apply the Ubuntu, Debian, Fedora and Gentoo security updates referenced in the advisories for the affected packages.
- If patching cannot be done immediately, restrict SMTP access to trusted hosts and disable unnecessary exposure of the MTA to the internet.
- Monitor Exim vendor advisories and the referenced bug 2449 for any further guidance or regression fixes.
Detection
- Inspect SMTP logs for abnormally long or malformed EHLO commands and for Exim crashes or restarts correlated with inbound connections.
- Monitor for unexpected child processes, shell execution or outbound connections originating from the Exim service account.
- Use host-based memory corruption or crash telemetry (core dumps, segfaults) on mail servers running Exim 4.92 through 4.92.2.
- Alert on exploitation attempts using network signatures for oversized EHLO parameters against SMTP ports.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2019-16928 to the Known Exploited Vulnerabilities catalog on 3 March 2022 as "Exim Out-of-bounds Write Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 March 2022.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-16928 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-16928), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
