CVE-2020-28017 Integer overflow in n/a
An integer overflow in Exim's recipient handling can lead to buffer overflow, potentially allowing remote code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28017?
CVE-2020-28017 is a critical vulnerability in Exim Exim, published on 6 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exim 4 before 4.94.2 allows Integer Overflow to Buffer Overflow in receive_add_recipient via an e-mail message with fifty million recipients. NOTE: remote exploitation may be difficult because of resource consumption.
Weakness: CWE-190
Which versions are affected by CVE-2020-28017?
It affects 1 product.
Products include Exim Exim.
How do I fix CVE-2020-28017?
Upgrade to a fixed version.
Is CVE-2020-28017 being exploited?
There is no known exploitation of CVE-2020-28017 in the wild and no public exploit code.
Other vulnerabilities in Exim Exim
Sources
Also known as CLEANSTART-2025-IG82231, DEBIAN-CVE-2020-28017, GHSA-3g7c-3hhg-325m, UBUNTU-CVE-2020-28017.