CVE-2018-6789: Exim Buffer Overflow Allows Remote Code Execution
What It Is — A buffer‑overflow flaw in Exim’s base64d routine within the SMTP listener can be triggered remotely to execute arbitrary code on the mail server. The vulnerability carries a CVSS 3.1 base score of 9.8 (Critical).
Exploitability — Public proof‑of‑concept code exists and the vulnerability has been observed in the wild, making exploitation feasible without authentication.
Affected Products — All Exim Mail Transfer Agent installations prior to the vendor‑released patch (version 4.92.2 and later).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability monitoring and timely patching are essential evidence of due‑diligence for the control objective of secure configuration and change management.
- An unpatched Exim server can become a foothold for attackers, breaking the assurance that mail infrastructure is protected—a key requirement across most compliance frameworks.
- Documented remediation (patch version, date, verification) provides a defensible audit trail that enterprise buyers increasingly demand during security reviews.
Recommended Actions
- Inventory all Exim instances and verify the running version.
- Upgrade to Exim 4.92.2 or later (or apply the vendor’s back‑ported patch).
- Record the patching activity in a centralized Trust Center to retain audit‑ready evidence.
- Integrate the fix into your vulnerability‑management workflow and ensure continuous scanning for future exposures.
Source: CISA KEV – CVE‑2018‑6789