CVE-2025-67896 is a high severity (CVSS 7.0) heap based buffer overflow in Exim before 4.99.1. It appears only with certain non-default rate limit configurations. Upgrade to Exim 4.99.1, or to a distribution package that explicitly backports the fix for this CVE.
What's affected
Exim before 4.99.1, with certain non-default rate limit configurations, per the record. The Exim project's security page and an oss-security post list a coordinated public release of the fix, tag exim-4.99.1, on 2025-12-18.
Distribution packages often carry their own version numbers and backport fixes without moving to 4.99.1. A package that still reports an older Exim version may or may not be fixed. Check your distribution's security tracker for the CVE instead of judging by the number alone.
I could not read the full project report text, so details beyond the record, such as the exact configurations involved, should be checked on the Exim security page.
How to check if you're exposed
Find your Exim version and whether you use rate limiting:
exim -bV | head -3
exim -bP configure_file
grep -rn "ratelimit" /etc/exim4 /etc/exim 2>/dev/null
The ratelimit condition in an ACL is where rate limits are set up. If the search finds nothing, the described non-default configuration is likely not in use, though you should still upgrade.
On Debian and Ubuntu, check the package changelog for the CVE:
apt changelog exim4-base | grep -i CVE-2025-67896
What to do now
- Find all Exim servers and their versions.
- Upgrade to 4.99.1 or install the distribution package that lists this CVE as fixed.
- Check ACLs for the ratelimit condition and note where it is used.
- Restart Exim after the update and confirm the running version with exim -bV.
- Watch the Exim security page for follow up advisories.
Why it matters
The weakness is CWE-122, heap based buffer overflow. The record explains the cause: database records are cast directly to internal structures without validation. If the stored data does not match what the code expects, the program can write past a heap buffer.
Exim is internet facing mail transfer software, so any remote memory corruption deserves attention, even when it needs a non-default setting. The score of 7.0 reflects that extra condition. Mail servers are often patched slowly because they are treated as stable infrastructure. The record does not list this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my default Exim install affected?
The record says only certain non-default rate limit configurations are affected. Check your ACLs for ratelimit and upgrade anyway.
My distro still shows an older Exim version. Am I safe?
Not necessarily. Distributions backport fixes, so read the package changelog or security tracker for this CVE.
Sources
- Safeguard Gold page for CVE-2025-67896
- Exim oss-security coordinated release post (fetched)
- Exim project security page (listed in the record)
Last reviewed: 18 October 2026.
