CVE DATABASE / CVE-2019-16928
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
CVSS 9.8 · CRITICAL
⚠ CISA KEV — ACTIVELY EXPLOITED
On the CISA KEV catalog
Confirmed exploited in the wild. Added 2022-03-03.
Federal remediation due 2022-03-17.
Required action: Apply updates per vendor instructions.
Summary
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.
CVSS 3.1 breakdown
| Base score | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Exim eximCanonical ubuntu linuxDebian debian linuxFedoraproject fedora
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://www.openwall.com/lists/oss-security/2019/09/28/1
- http://www.openwall.com/lists/oss-security/2019/09/28/2
- http://www.openwall.com/lists/oss-security/2019/09/28/3
- http://www.openwall.com/lists/oss-security/2019/09/28/4
- https://bugs.exim.org/show_bug.cgi?id=2449
- https://git.exim.org/exim.git/commit/478effbfd9c3cc5a627fc671d4bf94d13670d65f
- https://lists.exim.org/lurker/message/20190927.032457.c1044d4c.en.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EED7HM3MFIBAP5OIMJAFJ35JAJABTVSC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T3TJW4HPYH3O5HZCWGD6NSHTEBTTAPDC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UY6HPRW7MR3KBQ5JFHH6OXM7YCZBJCOB/
- https://seclists.org/bugtraq/2019/Sep/60
- https://security.gentoo.org/glsa/202003-47
- https://usn.ubuntu.com/4141-1/
- https://www.debian.org/security/2019/dsa-4536
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16928
Data: NIST NVD + CISA KEV. NVD last modified 2025-11-07. Always verify against the vendor advisory before acting.