CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation
Published Jun 5, 2019 · updated Jun 16, 2026 · exim exim
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Timeline
Detection, updates, and resolution for this record.
Jun 5, 2019 · Catalog
Detected
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Jan 10, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jul 10, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
Required action
Apply updates per vendor instructions.
CISA due date Jul 10, 2022
Affected
- cpe canonical/ubuntu linux18.04
- cpe canonical/ubuntu linux18.10
- cpe debian/debian linux9.0
- cpe exim/eximversion unspecified
- vendor Exim Mail Transfer Agent (MTA)version unspecified
Sources
- CISA KEVCVE-2019-10149
Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
cisa.gov - CVE.orgCVE-2019-10149
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-10149
30-day exploitation probability 100.0%
first.org - Exploit Database46996
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47307
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/local/exim4_deliver_message_priv_esc
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-10149
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/153218/Exim-4.9.1-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/153312/Exim-4.91-Local-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/154198/Exim-4.91-Local-Privilege-Escalation.html
Packet Storm link already published on the finding.
packetstormsecurity.com