Title: Exim Security Advisory for EXIM-Security-2026-06-22.3 / GCVE-25-2026-07-45-3 Announced: 2026-07-22 Affects: Exim 4.82 up to and including 4.99.4 Corrected: Exim 4.99.5 Exim Security Vulnerability: EXIM-Security-2026-06-22.3 ========================================================= Identifier: EXIM-Security-2026-06-22.3 (GCVE-25-2026-07-45-3) Type: Command execution with alternate privilege Severity: Medium Credit: The unnamed and uncredited authors whose works were ingested as the training corpus Timeline -------- 2026-06-22 20:11 UTC Report received 2026-06-23 11:57 UTC Fix drafted 2026-07-12 12:00 UTC GCVEs assigned by [GNA](https://gcve.eu/gna/25/) 2026-07-13 19:25 UTC Advance notice sent to distros@vs.openwall.org 2026-07-15 11:05 UTC Fix branch and tag exim-4.99.5 pushed to exim-distros 2025-07-22 14:00 UTC Public release Vulnerability Summary --------------------- A local user having a .forward file can use a string-expansion there. With certain Exim configurations this can be used as a privilege escalation. Affected Versions ----------------- - Exim versions from 4.82 (2013) up to and including 4.99.4 are affected. The development version (master) was affected as well. - To reach the vulnerable code, the attacker needs a local account on the system. - The Exim configuration must include all of: - a redirect router implementing .forward facilities for local users - a pipe transport accessible by that router - the pipe transport having the "force_command" option set - the pipe transport configured to run as a privileged user Mitigation ---------- Do not set "force_command" on pipe transports. Resolution ---------- The issue is resolved in Exim version 4.99.5. All users of affected versions are strongly encouraged to upgrade. The fix removes, under "force_command", the expansion of a local_part in a pipe transport. Downloads --------- The new version is available from the usual locations: - https://ftp.exim.org/pub/exim/exim4/ - https://code.exim.org/exim/exim (branch exim-4.99+fixes, tag exim-4.99.5) The release tag exim-4.99.5, signed by Jeremy Harris , key A986F3A6BD6377D8730958DEBCE58C8CE41F32DF