CVE-2019-16928: Exim Out-of-bounds Write Vulnerability

Vulnerability summary

CVE-2019-16928 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in Exim Exim Internet Mailer. It is known to be exploited: CISA lists it, first on 03-03-2022. EPSS estimates a 41.64% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 27-09-2019
   PublishedVulnerability first disclosed.
2. 03-03-2022
   Added to CISA KEVExim Out-of-bounds Write Vulnerability
3. 17-03-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.