Exim · PROXY parser

Exim: pre-authentication stack leak

Identifier: CVE-2026-48840
Disclosed: 2026-05-29
Coordinated release: 2026-05-29
Credit: Warisjeet Singh

Malformed PROXY frames can disclose live stack bytes before SMTP authentication when the sender is trusted by hosts_proxy, exposing an ASLR-defeat primitive.

Exhibit 01The evidence: the advisory, verbatim

exim.org · EXIM-Security-2026-05-19.1coordinated release 2026-05-29

Identifier:   EXIM-Security-2026-05-19.1 (CVE-2026-48840)
Type:         Pre-authentication information disclosure (uninitialised stack)
Severity:     Moderate (CVSS 5.3)
Credit:       Warisjeet Singh (sin99xx)

2026-05-19 12:35 UTC: Initial security report received from Warisjeet Singh (sin99xx).
2026-05-19 13:26 UTC: Exim maintainers acknowledge the report.
2026-05-19 14:06 UTC: Root cause confirmed; fix prepared in private repositories.
2026-05-29 14:00 UTC: Public coordinated release of the fix and advisory.