Exim on Debian 13: DSA-6522-1 (SMTP smuggling, PROXY flaws) and DSA-6400-1 (local privilege escalation)

Debian has released two more Exim updates for Debian 13 (trixie) since the May fixes. DSA-6400-1 (24 July 2026) fixed two flaws that may let a local user escalate privileges. DSA-6522-1 (27 September 2026) fixed three issues that, according to Debian, could result in SMTP smuggling, information disclosure, denial of service or arbitrary code execution.

Debian 12 (bookworm) did not receive either update. On 31 October 2026 the Debian security tracker lists bookworm's Exim (4.96-15+deb12u10) as vulnerable to all five CVEs, with no LTS advisory yet.

At a glance

What the vulnerabilities are

July: local privilege escalation (DSA-6400-1)

• CVE-2026-66140 (Exim: High; CVSS 8.4): command-line arguments meant to pass a queue name through Exim's own execution chain can be abused to reach files outside the spool directory, which can lead to privilege escalation. Exim says the attacker needs command-line access to the system and lists no mitigation.
• CVE-2026-66141 (Exim: Medium): a local user with a .forward file can use a string expansion that, in one specific setup, escalates privileges. All of these must be true: a redirect router for .forward files, a pipe transport reachable from it, force_command set on that transport, and the transport running as a privileged user. Exim's mitigation is not to set force_command on pipe transports.

Exim fixed both in upstream 4.99.5.

September: PROXY protocol and SMTP smuggling (DSA-6522-1)

• CVE-2026-94054 (Exim: High): with PROXY protocol in use, a buggy or compromised proxy can make Exim read past a heap buffer and write a NUL byte.
• CVE-2026-94056 (Exim: High): in the same setup, stack data can leak to the remote side.
• CVE-2026-94057 (Exim: Medium): SMTP smuggling. If a message is rejected during the DATA phase and crafted data follows the rejection point, Exim may accept a different message from the one the sending system sent and logged. Exim notes that the smuggled message still goes through your normal processing. It affects all Exim versions up to 4.100 and has no mitigation.

Exim fixed these in upstream 4.100.1. None of the five CVEs is in the CISA Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

dpkg-query -W -f='${Package} ${Version}\n' 'exim4*'
apt policy exim4-daemon-light exim4-daemon-heavy
sudo exim4 -bP hosts_proxy
sudo exim4 -bP transports | grep -nE 'driver|force_command|user'

Trixie needs 4.98.2-1+deb13u5 for everything here. On bookworm, the PROXY issues only matter if hosts_proxy is set, CVE-2026-66141 only with force_command on a pipe transport, CVE-2026-66140 needs a local account with a shell, and the smuggling issue applies to any Exim that receives mail.

How to update

On Debian 13 (trixie):

sudo apt update
sudo apt install --only-upgrade exim4 exim4-base exim4-config exim4-daemon-light exim4-daemon-heavy
apt policy exim4-daemon-light

On Debian 12 (bookworm) there is no fix to install yet. Until a DLA appears on the exim4 tracker page:

• Remove force_command from pipe transports, as Exim recommends.
• Keep hosts_proxy empty unless you need it, and if you do, list only your own proxy's exact addresses.
• Limit shell accounts on mail servers to administrators.
• Plan the move to trixie, where these fixes are already available.

Restart or reboot?

No reboot. Restart Exim and confirm it is running:

sudo systemctl restart exim4
sudo systemctl status exim4 --no-pager
exim4 -bV | head -1

Sources

• security-tracker.debian.org/tracker/DSA-6522-1
• debian.org/security/2026/dsa-6522
• lists.debian.org/debian-security-announce/2026/msg00435.html
• security-tracker.debian.org/tracker/DSA-6400-1
• debian.org/security/2026/dsa-6400
• lists.debian.org/debian-security-announce/2026/msg00311.html
• security-tracker.debian.org/tracker/exim4
• security-tracker.debian.org/tracker/CVE-2026-66140
• security-tracker.debian.org/tracker/CVE-2026-94057
• exim.org/static/doc/security/EXIM-Security-2026-06-22.1/EXIM-Security-2026-06-22.1.txt
• exim.org/static/doc/security/EXIM-Security-2026-06-22.3/EXIM-Security-2026-06-22.3.txt
• exim.org/static/doc/security/EXIM-Security-2026-09-12.1/EXIM-Security-2026-09-12.1.txt
• exim.org/static/doc/security/EXIM-Security-2026-09-12.2/EXIM-Security-2026-09-12.2.txt
• exim.org/static/doc/security/EXIM-Security-2026-09-12.4/EXIM-Security-2026-09-12.4.txt
• cve.org/CVERecord?id=CVE-2026-66140
• cve.org/CVERecord?id=CVE-2026-94054
• cve.org/CVERecord?id=CVE-2026-94057
• cisa.gov/known-exploited-vulnerabilities-catalog
• manpages.debian.org/trixie/exim4-daemon-light/exim4.8.en.html