CVE-2010-4344 Exim Heap-Based Buffer Overflow

Exploited in the wild Critical 9.8 Published 14 Dec 2010 Updated 22 Oct 2025

Remote attackers can execute arbitrary code on Exim mail servers via a heap-based buffer overflow triggered by crafted SMTP sessions.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2010-4344?

CVE-2010-4344 is a critical memory corruption vulnerability in Canonical Ubuntu Linux, published on 14 Dec 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Heap-based buffer overflow in the string_vformat function in string.c in Exim before 4.70 allows remote attackers to execute arbitrary code via an SMTP session that includes two MAIL commands in conjunction with a large message containing crafted headers, leading to improper rejection logging.

Weakness: CWE-787

Which versions are affected by CVE-2010-4344?

It affects 4 products.

Linux distribution packages (40)

`exim` Red Hat:enterprise_linux:4::as	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-doc` Red Hat:enterprise_linux:4::as	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-mon` Red Hat:enterprise_linux:4::as	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-sa` Red Hat:enterprise_linux:4::as	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim` Red Hat:enterprise_linux:4::desktop	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-doc` Red Hat:enterprise_linux:4::desktop	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-mon` Red Hat:enterprise_linux:4::desktop	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-sa` Red Hat:enterprise_linux:4::desktop	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim` Red Hat:enterprise_linux:4::es	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-doc` Red Hat:enterprise_linux:4::es	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-mon` Red Hat:enterprise_linux:4::es	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-sa` Red Hat:enterprise_linux:4::es	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim` Red Hat:enterprise_linux:4::ws	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-doc` Red Hat:enterprise_linux:4::ws	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-mon` Red Hat:enterprise_linux:4::ws	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim-sa` Red Hat:enterprise_linux:4::ws	All versions	`0:4.43-1.RHEL4.5.el4_8.1`
`exim` Red Hat:enterprise_linux:5::client	All versions	`0:4.63-5.el5_5.2`
`exim-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`0:4.63-5.el5_5.2`
`exim-mon` Red Hat:enterprise_linux:5::client	All versions	`0:4.63-5.el5_5.2`
`exim-sa` Red Hat:enterprise_linux:5::client	All versions	`0:4.63-5.el5_5.2`
`exim` Red Hat:enterprise_linux:5::server	All versions	`0:4.63-5.el5_5.2`
`exim-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`0:4.63-5.el5_5.2`
`exim-mon` Red Hat:enterprise_linux:5::server	All versions	`0:4.63-5.el5_5.2`
`exim-sa` Red Hat:enterprise_linux:5::server	All versions	`0:4.63-5.el5_5.2`
`exim` Red Hat:rhel_eus:4.7::as	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-debuginfo` Red Hat:rhel_eus:4.7::as	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-doc` Red Hat:rhel_eus:4.7::as	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-mon` Red Hat:rhel_eus:4.7::as	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-sa` Red Hat:rhel_eus:4.7::as	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim` Red Hat:rhel_eus:4.7::es	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-debuginfo` Red Hat:rhel_eus:4.7::es	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-doc` Red Hat:rhel_eus:4.7::es	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-mon` Red Hat:rhel_eus:4.7::es	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim-sa` Red Hat:rhel_eus:4.7::es	All versions	`0:4.43-1.RHEL4.5.el4_7.1`
`exim` Red Hat:rhel_eus:5.3	All versions	`0:4.63-3.el5_3.1`
`exim-debuginfo` Red Hat:rhel_eus:5.3	All versions	`0:4.63-3.el5_3.1`

Products include Canonical Ubuntu Linux, Debian Debian Linux, Exim Exim, Opensuse Opensuse.

How do I fix CVE-2010-4344?

Upgrade to a fixed version. US federal agencies must fix it by 15 Apr 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2010-4344 being exploited?

Yes. Attackers have exploited CVE-2010-4344 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2010-4344, DSA-2131-1, GHSA-mvgg-qcrq-7wr8, RHSA-2010:0970.