← Vulnerability Intelligence

CVE-2010-4344

Critical 9.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Exim Heap-Based Buffer Overflow Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Metrics

CVSS 3.1
9.8 (CRITICAL) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS — exploit probability
72% (percentile: 99) as of 1 November 2026
CWE
CWE-787

Affected products

exim: exim; opensuse: opensuse; debian: debian linux; canonical: ubuntu linux

References