Ubuntu Exim Critical Information Disclosure Notice 8353-1 CVE-2026-48840

ubuntu

June 1, 2026

Exim could be made to expose sensitive information over the network.

Summary

Exim could be made to expose sensitive information over the network.

Software Description:

- exim4: Exim is a mail transport agent

Details:

Warisjeet Singh discovered that Exim with SUPPORT_PROXY enabled did not

properly handle memory before SMTP authentication. A remote attacker could

possibly use this issue to obtain sensitive information.

Topics Covered

security advisory information leak remote access exim Ubuntu important

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  exim4                           4.99.1-1ubuntu1.3
  exim4-base                      4.99.1-1ubuntu1.3
  eximon4                         4.99.1-1ubuntu1.3

Ubuntu 25.10
  exim4                           4.98.2-1ubuntu2.3
  exim4-base                      4.98.2-1ubuntu2.3
  eximon4                         4.98.2-1ubuntu2.3

Ubuntu 24.04 LTS
  exim4                           4.97-4ubuntu4.6
  exim4-base                      4.97-4ubuntu4.6
  eximon4                         4.97-4ubuntu4.6

Ubuntu 22.04 LTS
  exim4                           4.95-4ubuntu2.9
  exim4-base                      4.95-4ubuntu2.9
  eximon4                         4.95-4ubuntu2.9

In general, a standard system update will make all the necessary changes.