CVE-2025-67896: Exim

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.

Affected products

• Exim Exim: before 4.99.1 (fixed in 4.99.1)

Published 2025-12-14. Last modified 2026-06-17.