Exim has released version 4.100.1 to address four security vulnerabilities in its mail transfer agent, including SMTP smuggling, heap corruption, stack-data leakage, and a use-after-free condition. The security update, announced on September 18, 2026, resolves issues tracked under four GCVE identifiers. Two high-severity vulnerabilities impact Exim's handling of Proxy Protocol traffic, while a medium-severity SMTP smuggling flaw affects all Exim versions through 4.100.
A remote attacker could trigger a read of approximately 230 bytes beyond a heap allocation, causing a single NUL-byte write immediately afterward. The flaw underscores the risk of trusting improperly validated metadata supplied by reverse proxies, load balancers, or other infrastructure components forwarding SMTP connections.
This vulnerability is present when Exim uses GnuTLS 3.6.4 or later, accepts TLS-on-connect connections, and has the non-default tls_early_banner_hosts setting enabled. An attacker can submit a message that differs from the original one sent and logged by the originating system if the transaction encounters a data-phase rejection and includes crafted content after the rejection point. Although normal configured processing still applies to the smuggled message, the discrepancy could undermine logging, message tracking, and policy-enforcement assumptions.
Administrators should review whether Proxy Protocol is enabled, validate the security posture of upstream proxies, and identify systems using tls_early_banner_hosts. Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
