CVE-2004-0399: Stack-based buffer overflow in Exim 3.35, and other versions before 4, when the sender_verify option is tru...

Security readout for executives and security teams

This old Exim mail-server flaw can be triggered remotely when sender verification is enabled. It can crash mail service and may allow code execution. Business urgency is highest for any internet-facing Exim 3.x or pre-4 deployment still operating, especially legacy mail gateways. Exposure is limited to systems running affected Exim versions before 4 with sender_verify enabled. The most likely exposed assets are legacy internet-facing SMTP servers, old appliances, or unsupported distribution builds still using Exim 3.x. Treat this as urgent only if legacy Exim remains in production. Modern environments should validate inventory, but an exposed pre-4 Exim server could create email outage risk and possible server compromise risk. Mitigation focus: Inventory Exim versions across mail servers and gateways.; Prioritize retirement or upgrade of Exim 3.x and other pre-4 builds.; Apply vendor or distribution guidance, including relevant Debian advisories where applicable..

Prepared

Jun 30, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.