Vulnerability record · CVE-2023-42118 · published 3 May 2024
CVE-2023-42118: Exim libspf2 SPF macro parsing integer underflow enables remote code execution
LLibspf2 Project · Libspf2
Exim's libspf2 does not properly validate user-supplied data when parsing SPF macros, causing an integer underflow before a memory write. This allows a network-adjacent, unauthenticated attacker to execute arbitrary code in the context of the service account. The flaw is rated CVSS 3.1 8.8 (High) and has a high EPSS probability, so it warrants prompt attention.
Description
Exim libspf2 Integer Underflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Exim libspf2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of SPF macros. When parsing SPF macros, the process does not properly validate user-supplied data, which can result in an integer underflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the service account. . Was ZDI-CAN-17578.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with no authentication required and a very high EPSS percentile, though not currently in KEV.
What it is
Exim's libspf2 does not properly validate user-supplied data when parsing SPF macros, causing an integer underflow before a memory write. This allows a network-adjacent, unauthenticated attacker to execute arbitrary code in the context of the service account. The flaw is rated CVSS 3.1 8.8 (High) and has a high EPSS probability, so it warrants prompt attention.
Impact
An attacker can execute arbitrary code with the privileges of the Exim service account, potentially leading to full compromise of the mail server and its data. No authentication or user interaction is required.
Attack surface
Reached over the network from an adjacent network position (AV:A) by sending crafted SPF macro data to the vulnerable Exim/libspf2 component. No authentication (PR:N) or user interaction (UI:N) is needed.
Exploitation
Not listed in CISA KEV and no public exploit references are provided, but EPSS is 0.51755 (98.9th percentile), indicating a high likelihood of exploitation activity.
What to do
- Apply the vendor patch for Exim/libspf2 as soon as it is available.
- If patching is not immediately possible, restrict network access to the Exim service to trusted hosts only.
- Disable or limit SPF macro processing if it is not required for mail flow.
- Monitor vendor and ZDI advisories for updated guidance and fixed versions.
- Run the Exim service with least privilege to limit the impact of code execution.
Detection
- Monitor Exim logs for crashes, abnormal restarts, or memory corruption errors related to SPF processing.
- Inspect network traffic for malformed or unusually long SPF macro strings reaching the mail service.
- Use host-based detection to watch for unexpected child processes or command execution spawned by the Exim service account.
- Correlate Exim process behavior with outbound connections or file writes that deviate from normal mail server activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1472/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2025/03/28/1 | Mailing List |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1472/ | Third Party Advisory |
Track CVE-2023-42118 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-42118), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
