CVE-2017-16943: Debian Linux

Critical severity, CVSS 9.8. EPSS: 47.1% chance of exploitation in the next 30 days.

The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

Affected products

• Debian Debian Linux: version 9.0 only
• Exim Exim: version 4.88 only; version 4.89 only

Published 2017-11-25. Last modified 2026-06-17.