CVE-2026-94055

Executive Summary

Exim versions before 4.100.1 contain a use-after-free vulnerability (CWE-416) that manifests when specific non-default TLS settings are configured in conjunction with the GnuTLS library. The flaw is rated CVSS 3.7 (Low), requiring network access and a high-complexity attack vector, with impact limited to availability. Organizations running Exim mail transfer agents with non-default GnuTLS TLS configurations are affected, though exploitation requires specific environmental preconditions.

Technical Analysis

This vulnerability is a use-after-free (CWE-416) in the Exim mail transfer agent, present in versions prior to 4.100.1. The flaw is explicitly tied to the interaction between Exim and the GnuTLS library, and only manifests "when certain non-default TLS settings are used." This conditional trigger is significant: default Exim installations using default TLS configuration are not exposed, which substantially narrows the affected population and explains the low CVSS score.

A use-after-free occurs when a program continues to reference a memory region after it has been freed. In TLS-handling code, such defects typically arise when a session context, cipher/certificate structure, or buffer associated with a TLS handshake or shutdown is released while a subsequent code path still holds a dangling pointer to it. Attacker-influenced timing or crafted TLS negotiation input can then cause the program to operate on freed memory.

Per the CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L):

• Attack Vector: Network — the flaw is reachable over the network (TLS handshake surface).
• Attack Complexity: High — requires non-default TLS settings and likely precise timing/conditions.
• Privileges Required: None.
• User Interaction: None.
• Impact: No confidentiality or integrity impact; Low availability impact, consistent with a crash/denial-of-service outcome (memory corruption that terminates the process) rather than reliable code execution.

Given the sparse NVD description, no specific function names, variable names, or code paths are asserted here. The mechanism is described at the vulnerability-class level: a dangling pointer to freed memory in the GnuTLS-integrated TLS handling path.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-94055 as of this report. The attack chain below is inferred strictly from the vulnerability class and the environmental preconditions stated in the NVD description.

1. Reconnaissance / target identification: An adversary identifies internet-facing SMTP servers running Exim. Banner grabbing on port 25/587 reveals Exim version strings; versions below 4.100.1 are candidate targets. The attacker must further infer that the target uses GnuTLS with non-default TLS settings (e.g., specific TLS option combinations), since the flaw only triggers under those conditions. This requirement makes blind exploitation unreliable and raises attack complexity, matching the AC:H rating.

2. Triggering the flaw class: The attacker initiates TLS negotiation with the Exim service. Because the defect is a use-after-free in the GnuTLS-integrated TLS path, triggering it requires driving the server through the specific TLS setting combination and negotiation/free sequence that leaves a dangling reference. An attacker would attempt to manipulate handshake timing or repeated connection setup/teardown to reach the freed-memory window.

3. Execution method (class-level): This is a memory-safety defect, not an injection flaw. There is no parameter, endpoint, or payload format that can be named from the available data. Exploitation consists of network-driven TLS interaction designed to dereference the freed object, causing the affected process to operate on invalid memory.

4. Post-exploitation impact: Per the CVSS subscores (C:N/I:N/A:L), the realistic impact is availability degradation — most likely a crash or restart of the Exim process, disrupting mail flow. No evidence in the provided data supports confidentiality or integrity compromise, nor reliable remote code execution, though use-after-free defects are theoretically code-execution-capable in some contexts; this is not substantiated here.

No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business impact centers on availability of email services. Exim is a widely deployed MTA, and disruption of a mail relay or gateway can interrupt inbound/outbound mail for the affected organization. However, three factors limit blast radius:

• Scope (S:U): impact is confined to the vulnerable component.
• Confidentiality/Integrity (C:N/I:N): no data exposure or modification expected.
• Availability (A:L): limited availability impact, consistent with intermittent crashes rather than total, sustained outage.

The high attack complexity (AC:H) and dependence on non-default TLS settings mean mass opportunistic exploitation is unlikely. Risk is highest for organizations that (a) expose Exim to untrusted networks and (b) deliberately configure non-default GnuTLS TLS options. Because there is no CISA KEV listing and no known exploit code, this is currently a lower-priority vulnerability relative to actively exploited Exim flaws, but it warrants patching as part of routine mail-infrastructure maintenance.

Detection Guidance

Sigma Rule

title: Exim Process Crash Indicative of TLS Use-After-Free (CVE-2026-94055)
id: 3f9c1a72-8b4e-4d21-9c0a-exim94055
status: experimental
description: Detects abnormal termination/crash of the Exim daemon consistent with a use-after-free in GnuTLS-integrated TLS handling.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94055
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection:
    - 'exim['
  keywords:
    - 'segmentation fault'
    - 'signal 11'
    - 'SIGSEGV'
    - 'SIGABRT'
    - 'TLS error'
  condition: selection and keywords
falsepositives:
  - Unrelated Exim crashes
  - TLS misconfiguration causing graceful shutdowns
level: low
tags:
  - attack.t1190
  - cve.2026.94055

YARA Rule

rule CVE_2026_94055_Exim_GnuTLS_UAF_Artifact
{
    meta:
        description = "Heuristic detection for Exim versions prior to 4.100.1 with GnuTLS TLS build indicators. Detection is version/banner based; no exploit payload exists."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94055"
        date = "2026-01-01"
        severity = "low"
    strings:
        $exim = "Exim" ascii wide
        $gnutls = "GnuTLS" ascii wide
        $ver = /Exim 4\.(9[0-9]|100)/
    condition:
        $exim and $gnutls and $ver
}

Suricata IDS Rule

alert tcp any any -> any 25 (msg:"CVE-2026-94055 Exim GnuTLS TLS Use-After-Free handshake activity (possible DoS)"; flow:to_server,established; content:"|16 03|"; depth:5; content:"Exim"; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-94055; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94055; sid:9405501; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [process where process.name == "exim" and event.action == "start"]
  [process where process.name == "exim" and event.action in ("end", "terminated") and process.exit_code != 0]

Splunk SPL Query

index=linux sourcetype=syslog "exim"
| regex _raw="(?i)(segmentation fault|signal 11|SIGSEGV|SIGABRT)"
| stats count values(_raw) as events by host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="exim,cve-2026-94055,">
  <rule id="940551" level="5">
    <decoded_as>syslog</decoded_as>
    <match>exim</match>
    <regex>(?i)(segmentation fault|signal 11|SIGSEGV|SIGABRT)</regex>
    <description>CVE-2026-94055: Exim crash possibly related to GnuTLS TLS use-after-free</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>availability,cve_2026_94055,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. No vendor fix or workaround text was available in the provided data; the sole remediation reference is the affected fixed version (4.100.1), which should be verified against the vendor before deployment.

1. Immediate mitigations:

   • Review Exim TLS configuration and identify any use of non-default GnuTLS TLS settings (the precise triggering combination is not disclosed in the available data). Where feasible, revert to default TLS settings until an upgrade is validated, since the flaw only manifests under non-default settings.
   • Restrict network access to Exim SMTP submission/listener ports (25/587) to trusted relays and clients via firewall/ACL rules to reduce exposure of the TLS handshake surface.
   • Monitor Exim process stability and restart-on-crash behavior; unexpected restarts may indicate attempted or incidental triggering.

2. Patch/upgrade steps:

   • Upgrade Exim to version 4.100.1 or later. The NVD description states the flaw affects "Exim before 4.100.1," which implies 4.100.1 contains the fix.
   • Because no vendor advisory is confirmed in the provided data, validate the fix against the official Exim project release notes and package-distributor errata before relying on the version number alone.
   • Stage the upgrade in a test environment that reproduces the non-default GnuTLS TLS configuration before production rollout.

3. Long-term hardening:

   • Track Exim releases and security announcements; Exim historically requires prompt patching.
   • Minimize non-default TLS options unless a documented requirement exists, and document the rationale where they are used.
   • Deploy process-level crash monitoring and alerting (see Detection Guidance) to catch availability-impacting memory-safety events early.
   • Consider memory-safety hardening (e.g., service supervision/auto-restart) to limit availability impact of any memory-corruption defect.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94055
• Exim Project (official release/security information): https://exim.org/
• MITRE CWE-416: Use After Free: https://cwe.mitre.org/data/definitions/416.html
• FIRST EPSS (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (this CVE is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on threat intelligence: No exploit code, Proof-of-Concept, Nuclei template, or CISA KEV entry exists for CVE-2026-94055 as of this report. No associated threat actor campaigns or in-the-wild exploitation evidence were identified in the provided data. EPSS has not yet scored this CVE; no EPSS value should be inferred. Additional technical detail (specific affected TLS option combinations, exact code paths) is not present in the available intelligence and is deliberately not fabricated here.