CVE-2019-16928

What is Exim?

Exim is a widely deployed open-source mail transfer agent (MTA) used to route and deliver email on Unix-like systems, and it is the default MTA on many Debian-based distributions. Because Exim is directly exposed to inbound SMTP traffic from the internet by design, memory-corruption bugs in its protocol-handling code are especially dangerous — remote attackers can reach the vulnerable code paths with nothing more than a crafted network connection.

Overview

CVE-2019-16928 is a critical heap-based buffer overflow vulnerability in Exim versions 4.92 through 4.92.2, reachable by sending a specially crafted, extremely long line during an SMTP session. Successful exploitation can crash the Exim process or lead to remote code execution. CVSS 3.1 base score 9.8 (Critical), requiring no authentication or user interaction.

Technical Details

This is CWE-787 (Out-of-Bounds Write). The flaw lies in Exim's internal string-formatting handling, where insufficient bounds checking during processing of an overly long recipient/line value allows data to be written past the end of an allocated heap buffer. Heap overflows of this kind can corrupt adjacent heap metadata or objects, and with careful crafting can be turned into full remote code execution running with Exim's process privileges — historically root on many default configurations, though the Exim project has worked over the years to reduce the amount of code running with elevated privileges.

Discovery

The vulnerability was reported to the Exim security team by an external researcher and coordinated through Exim's standard disclosure process; the Exim project released version 4.92.3 to address it.

Exploitation Context

CISA added CVE-2019-16928 to the KEV catalog in March 2022. Exim's ubiquity as a default MTA, combined with the fact that mail servers are inherently internet-facing, made this vulnerability attractive to attackers scanning for unpatched instances; Exim has a documented history of remotely exploitable vulnerabilities in 2019 (including CVE-2019-10149, the "Return of the WIZard" bug earlier that year) being rapidly weaponized in mass-scanning campaigns.

Remediation

1. Upgrade Exim to version 4.92.3 or later, which resolves CVE-2019-16928.
2. Verify your mail server is running a currently supported Exim release, since older unsupported branches will not receive further security fixes.
3. Restrict SMTP access where feasible (for example, limiting relay/submission ports to expected mail-exchange partners) while patching is scheduled.
4. Deploy network intrusion detection signatures capable of flagging anomalously long or malformed SMTP protocol lines.
5. Review mail server logs for crashes or unusual connection patterns that might indicate exploitation attempts during the exposure window.