CVE-2026-94054

Executive Summary

CVE-2026-94054 is an out-of-bounds write (CWE-787) in Exim mail transfer agent versions prior to 4.100.1, occurring when the Proxy-Protocol feature is used in conjunction with an attacker-controlled proxy. Successful exploitation requires the deployment to have enabled Proxy-Protocol support and to trust—or fail to properly validate—a proxy that an attacker controls, allowing the attacker to supply malformed proxy header data that triggers memory corruption. With a CVSS base score of 7.0 (High) and a vector reflecting high integrity impact (I:H) alongside low confidentiality and availability impact (C:L/A:L), the most credible outcome is remote code execution in the context of the Exim daemon process, though the High attack-complexity rating and unpatched status demand prioritized attention.

Technical Analysis

Exim is a widely deployed message transfer agent (MTA) that runs on the majority of internet-facing mail servers and often operates with elevated privileges. The vulnerability class here is an out-of-bounds write—CWE-787—which means memory is written outside the bounds of an intended buffer, corrupting adjacent memory structures. The trigger condition is specific: Proxy-Protocol must be enabled and the Exim instance must be receiving a connection from an attacker-controlled proxy.

The PROXY protocol is a lightweight header prefixed to a TCP connection that conveys the original client's source/destination address and port to the backend server behind a load balancer or reverse proxy. When Exim is configured to accept Proxy-Protocol headers, it parses this preamble before the SMTP session begins. An out-of-bounds write in this parsing path implies that insufficient validation of the length or format of attacker-supplied proxy header fields allows data to be written past the end of a fixed-size buffer in memory.

The critical precondition is the trust boundary. Proxy-Protocol data is inherently unauthenticated—the protocol carries no cryptographic proof of origin. If an Exim deployment accepts Proxy-Protocol connections from a network segment reachable by an attacker, or if ACLs/network controls are misconfigured so that an untrusted host can present itself as a proxy, the attacker gains the ability to craft arbitrary proxy headers. This is the "attacker-controlled proxy" condition stated in the NVD description.

The CVSS vector is instructive. AV:N confirms the attack is network-reachable. AC:H (High attack complexity) indicates the attacker must possess conditions beyond their own control or must perform reconnaissance to satisfy the deployment-specific precondition (Proxy-Protocol enabled and reachable). PR:N means no authentication is required—the attacker does not need credentials on the Exim host. UI:N means no user interaction is needed. S:U (Scope Unchanged) means the vulnerable component and the impacted component are the same security authority, so the breach is contained within the Exim process/security context. The subscore profile—I:H, with C:L and A:L—is consistent with a memory-corruption primitive that most reliably corrupts integrity (controlled writes) while confidentiality and availability impacts are secondary or inconsistent.

No function names, buffer names, or specific header field names are available from the description provided. Any claim of a specific parsing routine or code path would be speculative and is therefore withheld. What can be stated with confidence is the vulnerability class (out-of-bounds write), the attack surface (Proxy-Protocol header parsing), and the precondition (attacker-controlled proxy).

Patch confidence is 0/4: no patch evidence has surfaced from any tracked source, meaning no vendor fix, no commit reference, and no workaround is documented beyond the version gate implied by the description ("before 4.100.1"). Operators should treat all Exim versions below 4.100.1 that use Proxy-Protocol as at-risk.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-94054. The attack chain described below is inferred at the vulnerability-class level and does not rely on fabricated implementation details.

1) Reconnaissance / target identification. The attacker identifies internet-facing or internal Exim MTA instances. Because the flaw only manifests when Proxy-Protocol is enabled, the attacker must determine whether a target accepts Proxy-Protocol connections. This is typically satisfied when Exim sits behind a load balancer, TLS terminator, or reverse proxy configured to forward the PROXY header. Signals include SMTP banners revealing Exim version (e.g., "220 ... ESMTP Exim 4.x"), and the reachability of the listener port. Attack complexity is High precisely because the attacker must satisfy this deployment precondition and craft input that reliably corrupts memory.

2) Triggering the out-of-bounds write. The attacker opens a TCP connection to the Exim listener and, instead of or preceding a normal SMTP transaction, transmits a crafted Proxy-Protocol header. Because the write is an out-of-bounds condition, the attacker manipulates the structure, length, or framing of the proxy preamble to exceed a buffer boundary in the parsing logic. The "attacker-controlled proxy" element in the description is what makes this feasible: the attacker is the source of the header data and is not a trusted intermediary.

3) Payload/execution method. At the vulnerability-class level, an out-of-bounds write on a network-facing service is a memory-corruption primitive. Depending on the exact layout of the corrupted memory and the degree of attacker control over the written data and offset, the primitive can be steered toward corruption of adjacent data structures or control data. Whether reliable code execution is attainable, and what constraints apply, cannot be stated from the available description. No specific payload, gadget, or offset is documented.

4) Post-exploitation impact. Because Scope is Unchanged and the Exim daemon frequently runs with elevated privileges, a successful memory-corruption exploit would most plausibly yield code execution in the security context of the Exim process on the mail server. The CVSS integrity subscore of High indicates the attacker's writes are expected to reliably alter data; confidentiality and availability impacts are rated Low, suggesting data disclosure and service disruption are less consistent outcomes. Practical post-exploitation risks on a mail server include mail flow manipulation, credential exposure from mail spool/config, and use as a foothold into the internal network—but these are general consequences of compromising an MTA, not specific claims about this CVE.

Impact Assessment

Exim is among the most widely deployed MTAs on the public internet, and mail servers are high-value targets: they hold message content, authentication secrets, TLS private keys, and frequently sit at a network trust boundary. CVE-2026-94054 carries a CVSS base score of 7.0 (High). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L indicates the following:

• Confidentiality (Low): Some information exposure may result, but it is not the primary consequence.
• Integrity (High): The most significant rated impact—an out-of-bounds write is fundamentally an integrity violation of process memory, with potential for reliable modification of data.
• Availability (Low): Service disruption is possible but not the dominant risk; a crash may occur but sustained DoS is not the identified impact.
• Attack Complexity (High): Exploitation is not trivial; it depends on the Proxy-Protocol deployment condition and memory-layout factors.
• No privileges or user interaction required: Once the precondition is met, no credentials or victim action are needed.

Blast radius. Any Exim deployment below 4.100.1 that has enabled Proxy-Protocol and accepts connections from an untrusted or attacker-influenceable network segment is in scope. Environments where Exim sits behind a trusted, tightly controlled load balancer with strict network ACLs limiting who may send PROXY headers face materially lower risk than environments where the listener is broadly reachable. Because the fix threshold is a specific version (4.100.1), organizations should inventory all Exim instances and check both version and Proxy-Protocol configuration.

Although CVSS rates attack complexity as High, the combination of network reachability, no authentication requirement, and an unpatched status justifies treating this as a priority vulnerability for affected configurations. The absence of CISA KEV listing and public exploit code means exploitation in the wild is not currently evidenced—but KEV status and exploit availability can change, and defenders should not treat current non-exploitation as permanent.

Detection Guidance

Sigma Rule

title: Exim Proxy-Protocol Out-of-Bounds Write Attempt (CVE-2026-94054)
id: 8f3c1a2e-94054-4b1e-9c7d-eximproxyprot
status: experimental
description: Detects anomalous or malformed PROXY protocol preambles directed at Exim listeners, consistent with exploitation attempts against CVE-2026-94054.
author: valtersit.com Threat Intelligence
date: 2026/01/01
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94054
logsource:
  category: network_connection
  product: suricata
detection:
  selection_exim_port:
    dst_port:
      - 25
      - 465
      - 587
  selection_proxy_header:
    payload|startswith: 'PROXY '
  filter_known_proxies:
    src_ip:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
  condition: selection_exim_port and selection_proxy_header and not filter_known_proxies
falsepositives:
  - Legitimate proxy infrastructure originating outside the internal ranges
level: high
tags:
  - attack.t1190
  - cve.2026.94054

YARA Rule

rule CVE_2026_94054_Exim_ProxyProtocol_OOB
{
    meta:
        description = "Detects malformed PROXY protocol preambles targeting Exim (CVE-2026-94054) in packet captures or logs"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94054"
        date = "2026-01-01"
        cve = "CVE-2026-94054"

    strings:
        $proxy_hdr = "PROXY " ascii
        $tcp4 = "TCP4" ascii
        $tcp6 = "TCP6" ascii
        $unknown = "UNKNOWN" ascii

    condition:
        $proxy_hdr at 0 and
        (
            uint16be(0) == 0x5052 or  // 'PR'
            #tcp4 > 0 or
            #tcp6 > 0 or
            #unknown > 0
        )
}

Suricata IDS Rule

alert tcp any any -> any [25,465,587] (msg:"CVE-2026-94054 Exim Proxy-Protocol Out-of-Bounds Write Attempt"; flow:established,to_server; content:"PROXY "; depth:6; content:"TCP4"; within:64; pcre:"/^PROXY (TCP4|TCP6|UNKNOWN) [^\r\n]{1,512}\r\n/"; threshold:type both, track by_src, count 5, seconds 60; sid:9405401; rev:1; reference:cve,2026-94054; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94054; classtype:attempted-admin; metadata:service smtp;)

Elastic Detection

network where destination.port in (25, 465, 587) and
  network.transport == "tcp" and
  startsWith(network.protocol_data, "PROXY ") and
  not cidrMatch(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=zeek
| search dest_port IN (25, 465, 587) AND (data="PROXY*" OR payload="PROXY*" OR banner="PROXY*")
| where NOT cidrmatch("10.0.0.0/8", src_ip)
    AND NOT cidrmatch("172.16.0.0/12", src_ip)
    AND NOT cidrmatch("192.168.0.0/16", src_ip)
| stats count AS attempts, values(dest_ip) AS targets, values(dest_port) AS ports BY src_ip
| where attempts > 3
| sort - attempts
| table src_ip, attempts, targets, ports
| rename src_ip AS "Attacker Source", attempts AS "PROXY Header Attempts", targets AS "Target Exim Hosts", ports AS "Ports"

Wazuh OSSEC Rule

<group name="exim,cve-2026-94054,">
  <rule id="940540" level="12">
    <decoded_as>json</decoded_as>
    <field name="dst_port">25|465|587</field>
    <field name="payload">^PROXY </field>
    <description>CVE-2026-94054: Suspicious PROXY protocol preamble sent to Exim - possible out-of-bounds write exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>exim_proxy_protocol,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the flaw exists in "Exim before 4.100.1," implying that version 4.100.1 addresses it. However, no vendor advisory, commit reference, or patch source has been tracked or verified. Confirm the fix with the distribution/vendor before relying on it.

1) Immediate mitigations (apply now, do not wait for patch verification):

• Audit whether Proxy-Protocol is enabled in your Exim configuration. If it is not needed, disable Proxy-Protocol support entirely—this removes the attack surface.
• If Proxy-Protocol must remain enabled, enforce strict network-layer ACLs (firewall rules, hosts controls, load-balancer policy) so that only trusted proxies can reach the Exim listener. Never allow arbitrary/untrusted hosts to present PROXY headers.
• Rate-limit and length-limit inbound connections carrying PROXY preambles at the network edge (e.g., via the load balancer or a filtering proxy) and drop malformed preambles.
• Disable or restrict direct internet reachability of the Exim listener where architecture permits, placing it strictly behind a hardened, trusted proxy tier.
• Monitor for the detection signals above; a crash/restart loop of the Exim daemon coinciding with external connections should be treated as a possible exploitation attempt.

2) Patch/upgrade steps:

• Upgrade Exim to 4.100.1 or later as soon as a vendor-verified build is available for your distribution (e.g., via your OS package manager or the upstream Exim release).
• Before deploying, verify the package signature/checksum against the vendor source and confirm the fix version through an authoritative advisory, since patch confidence is currently 0/4.
• After upgrade, re-enable Proxy-Protocol only if required, and continue to enforce proxy trust boundaries.

3) Long-term hardening:

• Treat all PROXY protocol input as untrusted; ensure the MTA validates field lengths and formats rigorously (defense in depth beyond the patch).
• Maintain an inventory of all Exim instances with version, feature flags (especially Proxy-Protocol), and exposure profile.
• Subscribe to Exim security announcements and CISA/NVD bulletins; re-check KEV status periodically.
• Apply memory-safety mitigations at the OS level (ASLR, hardened allocator, compiler hardening) to raise the difficulty of exploiting residual memory-corruption bugs.
• Segment mail infrastructure so a compromised MTA does not provide a direct path into sensitive internal networks.

References

• NVD — CVE-2026-94054: https://nvd.nist.gov/vuln/detail/CVE-2026-94054
• MITRE CWE-787 (Out-of-bounds Write): https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Exim Project (upstream release information — verify 4.100.1 fix independently): https://exim.org/
• HAProxy PROXY Protocol specification (background on the protocol whose parsing is affected): https://www.haproxy.org/download/2.9/doc/proxy-protocol.txt

Threat actor / exploit-in-the-wild status: No public proof-of-concept, no exploit code, no Nuclei template, no CISA KEV listing, and no threat-actor campaign is associated with CVE-2026-94054 in the provided data. EPSS has not been scored by FIRST.org. Exploitation in the wild is not currently evidenced; defenders should nonetheless prioritize configurations that enable Proxy-Protocol, given the unpatched status and network-facing nature of Exim.