Exim <4.100.1: Proxy-Protocol Uninit Stack Data Leak
CVE-2026-94056 Published on September 19, 2026
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from stack memory.
Vulnerability Analysis
CVE-2026-94056 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a small impact on availability.
Weakness Type
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized. When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Products Associated with CVE-2026-94056
Want to know whenever a new CVE is published for Exim? stack.watch will email you.
Affected Versions
Exim:- Version 4.83 and below 4.100.1 is affected.