CVE-2010-4344: Exim Heap-Based Buffer Overflow Vulnerability

CVSS: 9.8v3.1CriticalKEVAnalyzed

AliasesRHSA-2010:0970DEBIAN-CVE-2010-4344DSA-2131-1

Published 14-12-2010Last modified 22-10-2025

Some data may be incomplete

1 reference with an unsupported link type was hidden.

Vulnerability summary

CVE-2010-4344 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in Exim. It is known to be exploited: CISA lists it, first on 25-03-2022. EPSS estimates a 71.71% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 7 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

71.71%

0%100%

Critical · 0.00 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits7reference, metasploit, exploit-database

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:10017-1

Timeline

14-12-2010
PublishedVulnerability first disclosed.
25-03-2022
Added to CISA KEVExim Heap-Based Buffer Overflow Vulnerability
15-04-2022
CISA remediation dueApply updates per vendor instructions.
22-10-2025
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.19.8v2.09.3

EPSS trend

Probability

71.71%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 71.71% on 21-09-2026

21-09-202621-10-2026

EPSS score

71.71%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 25-03-2022
Federal due date: 15-04-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2010-4344

Public exploits

7 found

referenceUnverified
Exploit Reference (exim.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
referenceUnverified
Exploit Reference (osvdb.org)
Maturity: unknown

Show all 7 exploits

referenceUnverified
Exploit Reference (openwall.com)
Maturity: unknown
MetasploitremoteVerified
Exim4 string_format Function Heap Buffer Overflow
exploit/unix/smtp/exim4_string_format
Maturity: weaponized
exploit-databaseremotelinuxVerified
Exim 4.63 - Remote Command Execution
Maturity: weaponized
exploit-databaseremotelinuxVerified
Exim4 < 4.69 - string_format Function Heap Buffer Overflow (Metasploit)
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Redhat5 products

exim< 0:4.43-1.RHEL4.5.el4_7.1 | < 0:4.43-1.RHEL4.5.el4_8.1 | < 0:4.63-5.el5_5.2 | < 0:4.63-3.el5_3.1 | < 0:4.63-3.el5_4.1
exim-debuginfo< 0:4.43-1.RHEL4.5.el4_7.1 | < 0:4.43-1.RHEL4.5.el4_8.1 | < 0:4.63-5.el5_5.2 | < 0:4.63-3.el5_3.1 | < 0:4.63-3.el5_4.1
exim-doc< 0:4.43-1.RHEL4.5.el4_7.1 | < 0:4.43-1.RHEL4.5.el4_8.1
exim-mon< 0:4.43-1.RHEL4.5.el4_7.1 | < 0:4.43-1.RHEL4.5.el4_8.1 | < 0:4.63-5.el5_5.2 | < 0:4.63-3.el5_3.1 | < 0:4.63-3.el5_4.1
exim-sa< 0:4.43-1.RHEL4.5.el4_7.1 | < 0:4.43-1.RHEL4.5.el4_8.1 | < 0:4.63-5.el5_5.2 | < 0:4.63-3.el5_3.1 | < 0:4.63-3.el5_4.1

Debian2 products

exim4< 4.69-9+lenny1 | < 4.70-1
debian_linuxEOL5.0

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 9.10

Exim1 product

exim< 4.70

Opensuse1 product

opensuseEOL11.1 | 11.2 | 11.3

5 vendors · 10 products

References

42 links

lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.htmlMailing ListX Refsource MLISTExploit
bugs.exim.org/show_bug.cgi?id=787X Refsource CONFIRMIssue TrackingPatch
www.securitytracker.com/id?1024858VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
www.redhat.com/support/errata/RHSA-2010-0970.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.vupen.com/english/advisories/2010/3186VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.securityfocus.com/bid/45308VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.metasploit.com/modules/exploit/unix/smtp/exim4_string_formatX Refsource MISCThird Party Advisory
atmail.com/blog/2010/atmail-6204-now-available/X Refsource CONFIRMBroken Link
secunia.com/advisories/42576Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory

Show all 42 references

secunia.com/advisories/42587Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=661756X Refsource CONFIRMExploitIssue TrackingREPORT
lists.exim.org/lurker/message/20101210.164935.385e04d0.en.htmlMailing ListX Refsource MLISTPatch
secunia.com/advisories/40019Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vupen.com/english/advisories/2010/3172VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.kb.cert.org/vuls/id/682457Third Party AdvisoryX Refsource CERT VNUS Government Resource
www.vupen.com/english/advisories/2010/3181VDB EntryX Refsource VUPENBroken LinkVendor Advisory
secunia.com/advisories/42586Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.vupen.com/english/advisories/2010/3317VDB EntryX Refsource VUPENBroken Link
www.ubuntu.com/usn/USN-1032-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.cpanel.net/2010/12/exim-remote-memory-corruption-vulnerability-notification-cve-2010-4344.htmlX Refsource CONFIRMBroken Link
www.osvdb.org/69685VDB EntryX Refsource OSVDBBroken LinkExploitPatch
www.securityfocus.com/archive/1/515172/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.theregister.co.uk/2010/12/11/exim_code_execution_peril/X Refsource MISCPress/Media Coverage
www.vupen.com/english/advisories/2010/3246VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.vupen.com/english/advisories/2010/3204VDB EntryX Refsource VUPENBroken LinkVendor Advisory
git.exim.org/exim.git/commit/24c929a27415c7cfc7126c47e4cad39acf3efa6bX Refsource CONFIRMMailing ListPatch
www.debian.org/security/2010/dsa-2131Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.vupen.com/english/advisories/2010/3171VDB EntryX Refsource VUPENBroken LinkVendor Advisory
secunia.com/advisories/42589Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
openwall.com/lists/oss-security/2010/12/10/1Mailing ListX Refsource MLISTThird Party Advisory
www.openwall.com/lists/oss-security/2021/05/04/7Mailing ListX Refsource MLISTExploit
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-4344Government ResourceUS Government Resource
access.redhat.com/errata/RHSA-2010:0970Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/kb/docs/DOC-43789ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0970.jsonAdvisory
access.redhat.com/security/cve/CVE-2010-4344REPORT
www.cve.org/CVERecord?id=CVE-2010-4344Advisory
nvd.nist.gov/vuln/detail/CVE-2010-4344Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLE
security-tracker.debian.org/tracker/CVE-2010-4344Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities