Privilege Escalation Vulnerability in Exim 4.96 to 4.98.1
Summary
CVE-2025-30232: A use-after-free in Exim 4.96 through 4.98.1 could allow users (with command-line access) to escalate privileges. Affects exim4 versions < 4.96-15+deb12u7. Fixed in 4.96-15+deb12u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Exim is a widely used mail transfer agent (MTA) that is responsible for routing and delivering email on Unix-like operating systems. It is known for its flexibility and extensive configuration options, making it a popular choice for email servers. However, versions 4.96 through 4.98.1 have been found to contain a critical use-after-free vulnerability that could allow users with command-line access to escalate their privileges, potentially compromising the security of the entire system.
Vulnerability Detail
The vulnerability, identified as CVE-2025-30232, arises from a use-after-free condition in Exim versions 4.96 to 4.98.1. This flaw allows an attacker with command-line access to exploit the memory management error, leading to unauthorized privilege escalation. If successfully exploited, an attacker could gain elevated privileges, allowing them to execute arbitrary commands or access sensitive data, thereby posing a significant risk to system integrity and confidentiality.
How To Fix
Minimum fixed version
4.96-15+deb12u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade exim4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict command-line access to the Exim service for untrusted users. This can be done by modifying user permissions and ensuring that only authorized personnel have access to the command line where Exim is running.
Conclusion
The CVE-2025-30232 vulnerability in Exim poses a serious risk of privilege escalation for users with command-line access. It is crucial to update to the patched versions to mitigate this risk. Temporary workarounds can be implemented while waiting for a full update.
See every vulnerability recorded for exim4 →
FAQ
CVE-2025-30232 is a vulnerability in Exim that allows users with command-line access to escalate their privileges due to a use-after-free condition.
Exim versions 4.96 through 4.98.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate update is not possible, restrict command-line access for untrusted users as a temporary workaround.
More information can be found in the related advisories such as DSA-5887-1, UBUNTU-CVE-2025-30232, and USN-7373-1.
Related vulnerabilities
Recent vulnerabilities recorded for exim4.
