CVE-2025-67896

Katalog CVE

CVSS 9.8 · Critical EPSS 0,47%

Kerentanan Heap-based Buffer Overflow pada exim. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records are cast directly to internal structures without validation.

Rincian

Terbit di NVD

14 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exim.org/static/doc/security/ advisory vendor
• https://exim.org/static/doc/security/EXIM-Security-2025-12-09.1/report.txt advisory vendor
• https://www.openwall.com/lists/oss-security/2025/12/11/2 mailing list
• http://www.openwall.com/lists/oss-security/2025/12/14/1 mailing list
• http://www.openwall.com/lists/oss-security/2025/12/18/3 mailing list