Critical 9.8Known exploited (CISA KEV)Published Dec 14, 2010

CVE-2010-4344Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conj…

Updated under an hour ago (Oct 26, 2026, 2:10 PM ET)

Does this affect you?

It affects exim and 3 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Mar 25, 2022; federal agencies had to remediate by Apr 15, 2022. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for exim

Exploited in the last 30 days

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

CVSS: 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-787
Known exploited: Added to CISA KEV Mar 25, 2022; federal remediation due Apr 15, 2022Apply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 71.71% (percentile 99)
Assigned by: redhat
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

exim exim exim:exim	before 4.70	NVD
opensuse opensuse opensuse:opensuse	11.1; 11.2; 11.3	NVD
debian debian_linux debian:debian_linux	5.0	NVD
canonical ubuntu_linux canonical:ubuntu_linux	6.06; 8.04; 9.10	NVD

References

References

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00003.html	vendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
http://www.exim.org/lurker/message/20101207.215955.bb32d4f2.en.html	mailing-list, x-refsource-mlist, exploit
http://bugs.exim.org/show_bug.cgi?id=787	x-refsource-confirm, issue-tracking, patch
http://www.securitytracker.com/id?1024858	vdb-entry, x-refsource-sectrack, broken-link, third-party-advisory
http://www.redhat.com/support/errata/RHSA-2010-0970.html	vendor-advisory, x-refsource-redhat, broken-link
http://www.vupen.com/english/advisories/2010/3186	vdb-entry, x-refsource-vupen
http://www.securityfocus.com/bid/45308	vdb-entry, x-refsource-bid, broken-link, third-party-advisory
http://www.metasploit.com/modules/exploit/unix/smtp/exim4_string_format	x-refsource-misc, third-party-advisory
http://atmail.com/blog/2010/atmail-6204-now-available/	x-refsource-confirm, broken-link
http://secunia.com/advisories/42576	third-party-advisory, x-refsource-secunia, broken-link, vendor-advisory
1–10 of 31

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.