CVE-2020-28010: Exim 4 before 4.94.2 allows Out-of-bounds Write because the main function, while setuid root, copies the cu...

Security readout for executives and security teams

This vulnerability affects Exim versions before 4.94.2. A flaw in the setuid-root startup path can write outside a buffer when handling the current working directory path. The main business concern is privilege escalation on systems running vulnerable Exim, especially shared or multi-user servers. Exposure is likely limited to systems with Exim installed before 4.94.2, particularly Unix-like mail servers or hosts where local users, services, or scripts can invoke Exim. The bundle does not identify specific distributions or package versions. Treat as a high-priority hygiene fix for internet-facing or shared mail infrastructure. The evidence does not prove active exploitation, but the setuid-root condition raises impact if an attacker already has local execution. Mitigation focus: Inventory all Exim installations and record exact versions.; Upgrade Exim to 4.94.2 or later where applicable.; Check operating-system vendor advisories for backported fixed packages..

Prepared

Jun 2, 2026, 19:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.