CVE-2023-42117 Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability

What is CVE-2023-42117?

CVE-2023-42117 is a high-severity memory corruption vulnerability in Exim Exim, published on 3 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Exim. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the smtp service, which listens on TCP port 25 by default. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17554.

Weakness: CWE-138

Which versions are affected by CVE-2023-42117?

It affects 1 product.

Products include Exim Exim.

How do I fix CVE-2023-42117?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-42117 being exploited?

There is no known exploitation of CVE-2023-42117 in the wild and no public exploit code.

Other vulnerabilities in Exim Exim

• CVE-2026-45185 Use after free in Exim Critical 9.8
• CVE-2023-42115 Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability Critical 9.8
• CVE-2020-28017 Integer overflow in n/a Critical 9.8
• CVE-2020-28018 Use after free in n/a Critical 9.8
• CVE-2020-28020 Integer overflow in n/a Critical 9.8

All Exim Exim vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2025-VV41786, CLSA-2023-1700160152, CLSA-2023-1701285323, CLSA-2023-1701285908, DEBIAN-CVE-2023-42117, GHSA-qf54-2qx8-3vcv and 2 more.